EUVD-2026-83388Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach MQTT endpoint on TCP 1883/8883
-
DeliveryEstablish MQTT session (unauthenticated or with credentials)
-
ExploitSubmit single transaction with unbounded message count
-
ExecutionExhaust broker memory or CPU
-
ImpactDenial of service for all connected clients
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The exact exploitation conditions are not confirmed from available data. Based on the description, exploitation requires network access to a running MQTT service endpoint (broker or client). MQTT brokers by default (port 1883) may allow unauthenticated connections depending on configuration; TLS-enabled brokers (port 8883) may require client certificates. The specific condition triggering the unbounded message path - whether any MQTT PUBLISH, SUBSCRIBE, or CONNECT message type triggers it - is unknown. Limiting factors: if the broker requires authentication (username/password or TLS client cert), exploitation requires valid credentials. The 'tx' scope suggests this may be constrained to specific transaction types within the MQTT session lifecycle. |
| Impact | Real-world risk cannot be fully assessed due to missing CVSS vector, CWE, EPSS score, KEV status, and patch information. Based solely on the description, the most likely impact is denial of service via resource exhaustion - an attacker (possibly unauthenticated depending on the broker configuration) floods a transaction with unlimited messages, exhausting memory or CPU. This is a DoS-class issue unless further analysis reveals a memory safety consequence. No public exploit has been identified. CVSS is absent - the assessed vector below is independently derived from the description. The product footprint is indeterminate without knowing which specific MQTT package in Ubuntu is affected. Defenders should treat this as low-to-medium urgency until a vendor advisory with patch and version details is published. |
| Exploit ScenarioDerived | An attacker with network access to an exposed MQTT endpoint sends a single transaction containing an unbounded stream of MQTT messages, causing the broker or client library to allocate memory without limit. This exhausts available memory or CPU, crashing the service or the host process and resulting in denial of service for all connected IoT clients. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 14, 2026
Resource exhaustion in an MQTT implementation tracked by Ubuntu allows an attacker to submit an unbounded number of messages within a single transaction, likely leading to memory or CPU exhaustion and denial of service. The affected component, version range, and exact package have not been confirmed from the available data - only Ubuntu's vendor tracking is present. No CVSS score, CWE, EPSS, KEV listing, or patch information was provided, making a full risk assessment impossible at this time.
RemediationAI
No vendor-released patch has been identified at time of analysis. Defenders should monitor Ubuntu Security Notices for a USN covering CVE-2026-57227. As a compensating control, MQTT brokers should be configured to enforce per-connection and per-session message rate limits and maximum inflight message counts where the software supports it. Network-level controls such as restricting MQTT port (default TCP 1883/8883) access to trusted clients can reduce the attack surface. If the affected component is a broker daemon, consider placing it behind an authenticated reverse proxy or access-control list until a patch is available. These mitigations reduce exposure but do not eliminate the underlying resource-limit flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MQTT (Message Queuing Telemetry Transport) is a lightweight publish-subscribe protocol widely used in IoT and embedded systems. The vulnerability descriptor 'unbounded number of messages per tx' indicates that a per-transaction message count limit is absent or not enforced, a class of resource-management weakness typically mapped to CWE-400 (Uncontrolled Resource Consumption) or CWE-770 (Allocation of Resources Without Limits or Throttling). The specific implementation - whether a userspace broker (e.g., mosquitto), a client library, or a kernel/RTOS module - is not identifiable from the available data. The descriptor format resembles Linux kernel or Zephyr RTOS commit message conventions, but this is inferred, not confirmed. Ubuntu is the sole reporting source, suggesting this CVE was assigned through Ubuntu's security tracking process.
Know when Suricata gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable MQTT endpoint, no authentication assumed by default, no confidentiality or integrity impact, denial of service only.
Primary rating from Vendor (vendor:ubuntu).
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
1DescriptionCVE.org
[mqtt: unbounded number of messages per tx]
Technical POC Analysis
CWE-400 (Uncontrolled Resource Consumption), specifically the child weakness CWE-770 (Allocation of Resources Without Limits or Throttling).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vul
OISF suricata-update version 1.0.0a1 contains an Insecure Deserialization vulnerability in the insecure yaml.load-Functi
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suric
An issue was discovered in Suricata before 6.0.4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploit
An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
Open Information Security Foundation Suricata prior to version 4.1.3 is affected by: Denial of Service - TCP/HTTP detect
Suricata before 4.0.5 stops TCP stream inspection upon a TCP RST from a server. Rated high severity (CVSS 7.5), this vul
The MemcmpLowercase function in Suricata before 2.0.6 improperly excludes the first byte from comparisons, which might a
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Exploit-DB