A memory leak vulnerability in tinyMQTT poses a significant risk of service disruption due to potential heap exhaustion from unauthenticated remote attackers.

The vulnerability stems from the broker's failure to properly validate or reject malformed UTF-8 strings within topic filters. An unauthenticated attacker can exploit this by sending repeated, specially crafted subscription requests, leading to unbounded memory allocation and eventual denial of service.

The inability to properly manage memory during subscription requests directly threatens the availability of the MQTT broker. Given the CVSS score of 7.5, this high severity flaw could result in significant downtime for critical messaging infrastructure, potentially halting dependent IoT or communication services.

Immediate Action: Monitor official repository channels for a fix and apply security updates as soon as they become available.

Proactive Monitoring: Review system logs for high frequencies of subscription requests or unusual memory consumption patterns that may indicate an ongoing denial of service attempt.

Compensating Controls: Implement rate limiting on incoming MQTT traffic and connection requests at the network perimeter to mitigate the impact of repeated malicious payloads.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Organizations utilizing tinyMQTT should prioritize the identification of their deployment version and prepare to patch immediately upon the release of a vendor fix. Until a patch is issued, ensure that network access to the broker is restricted to trusted sources to minimize the attack surface.