Aedes has Uncaught Exception and Uncontrolled Resource Consumption

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or structural complexity before passing topics through mqemitter into qlobber. A PUBLISH, SUBSCRIBE, or registered Will message containing an excessively deep topic can reach qlobber._split_words in lib/qlobber.js and trigger an uncaught too many words exception. Calls from handlers/subscribe.js and the publishing logic are not protected against that exception, so it escapes to the Node.js event loop and terminates the entire broker. The Will path is independently reachable when a client disconnects ungracefully: it calls broker.publish directly and bypasses the PUBLISH handler. An attacker must be able to establish an MQTT session, authenticated or unauthenticated according to broker configuration. A successful attack disconnects all legitimate clients and prevents reconnection until the broker process restarts. This issue is fixed in version 1.1.1.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…/aedes/security/advisories/GHSA-xxqp-5qx8-gj5q Diğer
• github.com/…ommit/b9024faa4cb416c4c6980760b4d7f55336315f2d Diğer
• github.com/moscajs/aedes/releases/tag/v1.1.1 Diğer

Kayıt geçmişi

1. 31 Eki 2026 01:09Yayımlandı

İlgili açıklar

• 5,5 CVE-2026-62250LibreDWG: unbounded allocation in pre-R13 DWG entity decoding
• 5,5 CVE-2026-62254LibreDWG: excessive class-decoding reallocation in R13-R2000 DWG parsing
• 6,5 CVE-2026-62300Filecoin Pin: Unbounded DAG pinning can exhaust filecoin-pin server resources
• 5,9 CVE-2026-62303Pistache: DoS via stack exhaustion in REST router path normalization (regex_replace on long slash runs)
• 6,3 CVE-2026-61848Crass: Non-ASCII characters cause superlinear CPU consumption
• 8,7 CVE-2026-62160Daptin'de Accept-Language başlığı ile CPU tüketimi (DoS) açığı