CVE-2026-63341CWE-248CWE-400denial-of-service

Aedes has Uncaught Exception and Uncontrolled Resource Consumption

High · published October 30, 2026

CVSS v3.1
7.5
EPSS
—
In the wild
Unconfirmed
What it is

Aedes is an MQTT broker that can run on any stream server. Prior to 1.1.1, the MQTT broker does not bound topic depth or structural complexity before passing topics through `mqemitter` into `qlobber`. A `PUBLISH`, `SUBSCRIBE`, or registered `Will` message containing an excessively deep topic can reach `qlobber._split_words` in `lib/qlobber.js` and trigger an uncaught `too many words` exception. Calls from `handlers/subscribe.js` and the publishing logic are not protected against that exception, so it escapes to the `Node.js event loop` and terminates the entire broker. The `Will` path is independently reachable when a client disconnects ungracefully: it calls `broker.publish` directly and bypasses the `PUBLISH` handler. An attacker must be able to establish an `MQTT session`, authenticated or unauthenticated according to broker configuration. A successful attack disconnects all legitimate clients and prevents reconnection until the broker process restarts. This issue is fixed in version 1.1.1.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
Not scored
Weaknesses
CWE-248 · Uncaught Exception; CWE-400 · Uncontrolled Resource Consumption
Published
2026-10-30T22:09Z
Timeline
  • 30 OCT 22:09Z
    Aedes has Uncaught Exception and Uncontrolled Resource Consumption
    cvelistv5
  • 30 OCT 22:09Z
    Aedes has Uncaught Exception and Uncontrolled Resource Consumption
    cvelistv5