MQTT Broker Vulnerability in Aedes by moscajs

CVE-2026-63341

What is CVE-2026-63341?

Aedes, an MQTT broker, is susceptible to a denial of service vulnerability when handling excessively deep topics before version 1.1.1. The broker's failure to limit topic depth allows for PUBLISH, SUBSCRIBE, or Will messages to trigger an uncaught too many words exception in qlobber, which can cause the entire broker to terminate. This can occur during both normal operations and when clients disconnect ungracefully, leaving legitimate users unable to reconnect until the broker is restarted. Users should upgrade to version 1.1.1 to mitigate this risk.

References