CVE-2026-63341 in Aedes
Summary
by MITRE • 10/31/2026
Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or structural complexity before passing topics through `mqemitter` into `qlobber`. A `PUBLISH`, `SUBSCRIBE`, or registered `Will` message containing an excessively deep topic can reach `qlobber._split_words` in `lib/qlobber.js` and trigger an uncaught `too many words` exception. Calls from `handlers/subscribe.js` and the publishing logic are not protected against that exception, so it escapes to the `Node.js event loop` and terminates the entire broker. The `Will` path is independently reachable when a client disconnects ungracefully: it calls `broker.publish` directly and bypasses the `PUBLISH` handler. An attacker must be able to establish an `MQTT session`, authenticated or unauthenticated according to broker configuration. A successful attack disconnects all legitimate clients and prevents reconnection until the broker process restarts. This issue is fixed in version 1.1.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/31/2026
The vulnerability identified in versions of the Aedes MQTT broker prior to release 1.1.1 represents a critical denial-of-service condition stemming from insufficient input validation regarding topic string complexity and depth. As an MQTT broker designed to operate on various stream servers, Aedes relies on external libraries for message routing and pattern matching, specifically utilizing mqemitter as the emitter interface and qlobber for topic subscription management. The core technical flaw lies in the absence of bounds checking or structural constraints applied to incoming MQTT topics before they are processed by these underlying components. When a client publishes a message, subscribes to a topic, or registers a Will message with an excessively deep hierarchical structure, the broker passes this unvalidated input directly into qlobber's internal logic without performing any preliminary sanitization or length verification steps that would typically prevent pathological inputs from reaching critical parsing routines.
The specific point of failure occurs within the qlobber library at the _split_words function located in lib/qlobber.js. This function is responsible for breaking down topic strings into individual words based on delimiter characters to facilitate pattern matching against subscription filters. When presented with a topic string that contains an abnormally high number of segments or excessive depth, this function throws an uncaught exception categorized as too many words. Because the Aedes broker does not wrap these specific code paths in try-catch blocks capable of handling such runtime errors, the exception propagates up through the call stack and escapes into the Node.js event loop. In a single-threaded environment like Node.js, an unhandled exception at this level results in the immediate termination of the entire process rather than just failing the individual request or connection attempt.
The operational impact of this vulnerability is severe, resulting in a complete service outage for all connected clients. A successful exploitation requires only that an attacker be able to establish an MQTT session with the broker, which may require authentication depending on the specific configuration settings enabled by the administrator. Once authenticated, the attacker can trigger the crash through multiple vectors within the protocol. The most direct path involves sending a PUBLISH message or issuing a SUBSCRIBE command containing the maliciously deep topic string. Additionally, there exists an independent and potentially more隐蔽 vector via Will messages. When a client disconnects ungracefully, such as by abruptly closing its TCP connection without sending a DISCONNECT packet, the broker is obligated to publish any previously registered Will message associated with that session. This code path invokes the broker's internal publishing logic directly, bypassing the standard PUBLISH handler where some validation might have theoretically occurred, thereby allowing an attacker who has established a session and set up a Will payload to trigger the crash upon disconnection without needing to send further messages after connection establishment.
From a security classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the system fails to verify that user-supplied input meets expected structural constraints before processing it in sensitive functions. It also corresponds to CWE-400 Uncontrolled Resource Consumption, specifically leading to resource exhaustion via process termination due to unhandled exceptions triggered by malformed data. In terms of adversarial tactics, this behavior is consistent with ATT&CK technique T1499 Endpoint Denial of Service, where an attacker aims to disrupt the availability of a specific endpoint or service component. The consequence of exploiting this flaw is not merely the loss of connectivity for the attacking client but the total unavailability of the MQTT broker until the process is manually restarted by system administrators, effectively denying service to all legitimate users relying on real-time messaging capabilities during that downtime.
Mitigation strategies primarily involve upgrading the Aedes installation to version 1.1.1 or later, where this issue has been resolved through the implementation of proper input validation and error handling mechanisms. Administrators should ensure that their deployment pipelines automatically apply these security patches to prevent exposure. In environments where immediate patching is not feasible due to operational constraints, network-level controls such as firewalls or reverse proxies can be configured to inspect MQTT traffic for abnormally long topic strings or excessive depth before forwarding requests to the broker instance. Additionally, implementing strict authentication policies ensures that only trusted entities can establish sessions capable of triggering these code paths, although this does not fully mitigate the risk if insider threats or compromised credentials are involved. Regular monitoring of broker logs for unexpected process restarts and configuring automatic recovery mechanisms where appropriate can help minimize the duration of service disruption in the event of a successful attack on unpatched systems.