CVE-2025-63235 in Sol
Summary
by MITRE • 08/07/2026
In sol commit 373d848 (2024-12-12), the broker does not fully release resources when handling malformed or duplicate CONNECT packets. When clients send invalid CONNECT packets - either due to repeated attempts or failed authentication - the server may silently drop the connection or send a CONNACK but fail to close the session or deallocate internal resources. This behavior allows an attacker to create numerous half-open connections that consume memory and file descriptors indefinitely, potentially triggering the Linux OOM killer and causing a denial of service.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability described in the sol commit 373d848 represents a critical resource management flaw in broker implementations that directly impacts system stability and availability. This issue manifests when the broker fails to properly release allocated resources during the handling of malformed or duplicate CONNECT packets, creating a persistent state where connections remain active in memory despite being effectively closed. The root cause lies in the incomplete cleanup process that occurs when clients send invalid CONNECT packets either through repeated connection attempts or authentication failures. The broker's response to these malformed packets involves either silently dropping the connection without proper resource deallocation or sending a CONNACK message while failing to close the associated session, leaving internal resources in an inconsistent state.
The technical implications of this vulnerability extend beyond simple resource leaks and create conditions conducive to denial of service attacks. When clients repeatedly send invalid CONNECT packets, the broker maintains references to these half-open connections indefinitely, consuming both memory resources and file descriptors that are typically limited by system constraints. This behavior creates a resource exhaustion scenario where the system's available file descriptor limits are gradually consumed, ultimately leading to a state where new legitimate connections cannot be established. The vulnerability aligns with CWE-400: Uncontrolled Resource Consumption, which specifically addresses situations where software fails to properly manage resources leading to system instability. The incomplete resource cleanup process can also trigger the Linux Out-of-Memory (OOM) killer, which terminates processes to free up memory and maintain system functionality, thereby causing unintended service disruption.
The operational impact of this vulnerability is particularly severe in high-traffic environments where attackers can leverage the resource leak to systematically consume available system resources. An attacker can establish numerous connections using malformed CONNECT packets that remain active in the broker's memory space, effectively creating a resource exhaustion attack that does not require sophisticated techniques or significant computational resources. This type of attack directly maps to ATT&CK technique T1499.004: Network Denial of Service, as it targets network service availability through resource consumption. The vulnerability is especially dangerous in broker environments where connection persistence and resource management are critical for maintaining service availability, as the attack can remain undetected while gradually consuming system resources until complete service disruption occurs.
Mitigation strategies for this vulnerability must address both immediate resource cleanup mechanisms and preventive measures against malformed packet handling. The most effective approach involves implementing proper resource cleanup routines that ensure all associated memory allocations and file descriptors are released regardless of the connection termination path taken by the broker. This includes establishing robust session management protocols that automatically clean up resources when connection states become invalid or when CONNACK messages are sent in response to malformed packets. System administrators should also implement connection rate limiting and monitoring mechanisms to detect abnormal connection patterns that may indicate exploitation attempts. Additionally, implementing proper timeout mechanisms for half-open connections and establishing resource limits through system configuration can help prevent complete service exhaustion. The fix should be integrated with standard security practices including regular vulnerability assessments and proper error handling procedures that align with secure coding guidelines established by organizations like the Open Web Application Security Project.