CVE-2026-30867: CocoaMQTT Denial of Service via Reachable Assertion in PUBLISH Packet Parsing
Summary
CVE-2026-30867: CocoaMQTT: Denial of Service via Reachable Assertion in PUBLISH Packet Parsing. Affects CocoaMQTT versions < 2.2.2. Fixed in 2.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CocoaMQTT is a Swift-based MQTT client library designed for iOS, macOS, and tvOS applications. It facilitates communication between devices using the MQTT protocol, which is lightweight and ideal for mobile and IoT applications. The library supports features such as message retention, quality of service levels, and secure connections. However, a vulnerability exists in its packet parsing logic that can lead to a denial of service (DoS) attack, impacting the stability of applications using this library.
Vulnerability Detail
A vulnerability in CocoaMQTT's packet parsing logic allows an attacker to crash the host application by sending a malformed PUBLISH packet. Specifically, when the Topic Length is set to zero, the library attempts to slice the byte array incorrectly, leading to an out-of-bounds access. This results in a runtime trap that crashes the application, effectively rendering it unusable until the retained message is removed from the broker. The vulnerability can be exploited by a malicious MQTT broker or an attacker publishing to a shared topic.
How To Fix
Minimum fixed version
2.2.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid subscribing to topics that may be controlled by untrusted sources or implement additional validation on incoming messages to filter out malformed packets.
Conclusion
The vulnerability CVE-2026-30867 in CocoaMQTT poses a significant risk of denial of service due to improper packet parsing. Users are advised to update to version 2.2.2 or later to mitigate this risk. Implementing workarounds and using tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for CocoaMQTT →
FAQ
The CVSS score of this vulnerability is 5.7, indicating a moderate severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By simply uploading your manifest file like package-lock.json, you can check for vulnerabilities in real-time.
Exploitation of this vulnerability can lead to a denial of service, causing the application to crash and become unusable until the retained message is cleared from the broker.
Yes, you can implement additional validation on incoming messages or avoid subscribing to untrusted topics as a temporary measure.
You can find more information about CocoaMQTT on its GitHub repository at https://github.com/emqx/CocoaMQTT.
