Remote Crash Vulnerability in CocoaMQTT MQTT Client for iOS and macOS

CVE-2026-30867

What is CVE-2026-30867?

CocoaMQTT, an MQTT 5.0 client library for iOS and macOS, contains a flaw in its packet parsing logic prior to version 2.2.2. This allows an attacker to exploit a malformed payload published to a shared topic with the RETAIN flag enabled, causing the application to crash upon connection to the broker. The vulnerability results in a persistent denial-of-service (DoS) condition, effectively 'bricking' the application until the retained message is manually removed from the broker database. Users are encouraged to update to version 2.2.2 or later to mitigate this risk.

References