Aedes
Monthly
Remote denial of service in the Aedes MQTT broker through version 1.1.0 lets any client able to open an MQTT session crash the broker process with a single over-deep PUBLISH or SUBSCRIBE topic, or by registering a Will message with such a topic that fires on ungraceful disconnect. The crash comes from a synchronous 'too many words' throw inside the qlobber topic matcher that Aedes does not catch, so it reaches the Node.js event loop and terminates the process, disconnecting every connected client and blocking reconnection until restart. The vendor advisory includes a public proof-of-concept script that reliably kills the official moscajs/aedes Docker image on the first packet; the fix ships in 1.1.1 as a topic-level guard defaulting to 100 levels.
An issue was discovered in MoscaJS Aedes 0.42.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Improper authorization in aedes version <0.35.0 will publish a LWT in a channel when a client is not authorized. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Remote denial of service in the Aedes MQTT broker through version 1.1.0 lets any client able to open an MQTT session crash the broker process with a single over-deep PUBLISH or SUBSCRIBE topic, or by registering a Will message with such a topic that fires on ungraceful disconnect. The crash comes from a synchronous 'too many words' throw inside the qlobber topic matcher that Aedes does not catch, so it reaches the Node.js event loop and terminates the process, disconnecting every connected client and blocking reconnection until restart. The vendor advisory includes a public proof-of-concept script that reliably kills the official moscajs/aedes Docker image on the first packet; the fix ships in 1.1.1 as a topic-level guard defaulting to 100 levels.
An issue was discovered in MoscaJS Aedes 0.42.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Improper authorization in aedes version <0.35.0 will publish a LWT in a channel when a client is not authorized. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.