sol MQTT broker Vulnerability Advisory: 5 CVEs incl. Auth Bypass, UAF, DoS

Vulnerability Overview 1. CVE-2025-63236 - NULL Pointer Dereference in sol (MQTT broker) - Description: A null pointer dereference vulnerability was discovered in the sol MQTT broker. The vulnerability occurs when handling non-CONNECT packets (such as SUBSCRIBE), violating the MQTT v3.1.1 specification and causing server crash. - Actual Behavior: The server fails to verify that the first packet is a CONNECT message, leading to a null pointer or bad pointer dereference and triggering SIGSEGV when a SUBSCRIBE is sent. - Trigger and Crash: The server processes messages without checking if they are the initial message, resulting in the error. 2. CVE-2025-63237 - Authentication Bypass in sol (MQTT broker) - Description: A protocol violation vulnerability (authentication bypass) was discovered in the sol MQTT broker. The server accepts and processes packets before receiving a CONNECT, violating the MQTT v3.1.0-1 specification. - Actual Behavior: The sol server does not enforce that the client's first packet must be CONNECT, allowing clients to bypass the authentication phase and directly send PUBLISH or SUBSCRIBE packets. - Trigger and Crash: By sending a PUBLISH packet, the server accepts and processes it, resulting in messages from unauthenticated clients being delivered to subscribers. 3. CVE-2025-63234 - Use After Free in sol (MQTT broker) - Description: A use-after-free vulnerability was discovered in the sol MQTT broker, involving improper handling of long Client IDs, violating the MQTT v3.1.1 specification. - Actual Behavior: The server incorrectly enforces a 23-byte Client ID length limit, truncating longer IDs and causing a segmentation fault. - Trigger and Crash: After establishing connections with two Client IDs having the same prefix, the second connection is mistaken for the first. When one client disconnects, the server accesses released resources, triggering a segmentation fault. 4. CVE-2025-63235 - Resource Exhaustion in sol (MQTT broker) - Description: A protocol compliance issue and potential Denial of Service (DoS) vulnerability was discovered in the sol MQTT broker, involving resource exhaustion during the handling of CONNECT packets. - Actual Behavior: When sol receives an invalid CONNECT packet, it does not follow MQTT v3.1.1 error handling rules, causing connection state to persist in memory and eventually exhausting system resources. - Trigger and Crash: By creating numerous TCP connections and sending invalid CONNECT packets, sol exhausts all available memory and file descriptors, eventually being terminated by the Linux OOM killer. 5. CVE-2025-63233 - Memory Leak in sol (MQTT broker) - Description: A specification compliance vulnerability involving memory leaks during the handling of retained QoS-0 messages was discovered in the sol MQTT broker. - Actual Behavior: When sol receives a QoS-0 PUBLISH packet with RETAIN=1, it fails to release the memory of the old message, leading to infinite memory growth. - Trigger and Crash: By sending QoS-0 PUBLISH packets with RETAIN=1, sol continuously allocates new message objects without releasing old ones, eventually leading to memory exhaustion. Scope of Impact Affected Version: sol commit 373d848 Operating System: Kali GNU/Linux Rolling 2023.4 Vulnerability Types: Null pointer dereference, authentication bypass, use-after-free, resource exhaustion, memory leak Attack Type: Remote Impact: Denial of Service (DoS), unauthorized message access, memory leak Remediation Specific Remediation: No specific remediation solution is provided on the page. It is recommended to refer to the official updates or patches from the sol project. POC Code CVE-2025-63236 - NULL Pointer Dereference in sol (MQTT broker) CVE-2025-63237 - Authentication Bypass in sol (MQTT broker) CVE-2025-63234 - Use After Free in sol (MQTT broker) CVE-2025-63235 - Resource Exhaustion in sol (MQTT broker) CVE-2025-63233 - Memory Leak in sol (MQTT broker) Summary This webpage screenshot details five vulnerabilities in the sol MQTT broker, including null pointer dereference, authentication bypass, use-after-free, resource exhaustion, and memory leak. Each vulnerability includes specific descriptions, actual behaviors, and trigger/crash scenarios, along with POC code. The affected version is sol commit 373d848, and the operating system is Kali GNU/Linux Rolling 2023.4. It is recommended to refer to the official updates or patches from the sol project for remediation.

Goal Reached Thanks to every supporter — we hit 100%!

sol MQTT broker Vulnerability Advisory: 5 CVEs incl. Auth Bypass, UAF, DoS

More from this source