An unauthenticated remote denial-of-service vulnerability exists in tinyMQTT due to flawed parsing of CONNECT packets.

The broker fails to correctly handle malformed CONNECT packets, which can be exploited by an unauthenticated attacker to trigger a crash or denial of service in the MQTT broker.

A CVSS score of 7.5 reflects the ease of exploitation (AV:N/AC:L) and the significant impact on availability. Successful exploitation can result in a complete loss of MQTT messaging services, potentially disrupting critical IoT or machine-to-machine communication flows.

Immediate Action: Restrict network access to the MQTT broker and monitor for vendor-provided patches addressing commit 6226ade15bd4f97be2d196352e64dd10937c1962.

Proactive Monitoring: Monitor broker logs for repeated connection failures or unexpected service restarts that may indicate exploitation attempts.

Compensating Controls: Deploy a WAF or protocol-aware firewall capable of inspecting and dropping malformed MQTT packets before they reach the broker.

Public Exploit Available: Unknown

Organizations relying on tinyMQTT should prioritize isolating the broker from untrusted networks. Until a formal patch is released, ensure that only authorized clients have network reachability to the broker to minimize exposure.