CVE-2026-30867 Details
Description
CocoaMQTT is a MQTT 5.0 client library for iOS and macOS written in Swift. Prior to version 2.2.2, a vulnerability exists in the packet parsing logic of CocoaMQTT that allows an attacker (or a compromised/malicious MQTT broker) to remotely crash the host iOS/macOS/tvOS application. If an attacker publishes the 4-byte malformed payload to a shared topic with the RETAIN flag set to true, the MQTT broker will persist the payload. Any time a vulnerable client connects and subscribes to that topic, the broker will automatically push the malformed packet. The app will instantly crash in the background before the user can even interact with it. This effectively "bricks" the mobile application (a persistent DoS) until the retained message is manually wiped from the broker database. This issue has been patched in version 2.2.2.
A denial-of-service vulnerability has been identified in CocoaMQTT, a MQTT 5.0 client library for iOS and macOS, prior to version 2.2.2. The issue arises in the packet parsing logic, where an attacker or a compromised MQTT broker can remotely crash the host application. This is achieved by publishing a 4-byte malformed payload to a shared topic with the RETAIN flag set to true. The MQTT broker persists this payload, and when a vulnerable client subscribes to the topic, the broker automatically pushes the malformed packet, causing the application to crash in the background. This effectively 'bricks' the mobile application, creating a persistent denial-of-service condition until the retained message is manually removed from the broker's database.
Users can upgrade to CocoaMQTT version 2.2.2 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/emqx/CocoaMQTT/commit/010bca6f61b97d726252f61641d331a2bf82b338 | [email protected] | Patch |
| https://github.com/emqx/CocoaMQTT/pull/659 | [email protected] | Issue TrackingPatch |
| https://github.com/emqx/CocoaMQTT/releases/tag/2.2.2 | [email protected] | Release Notes |
| https://github.com/emqx/CocoaMQTT/security/advisories/GHSA-r3fr-7m74-q7g2 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-617 | Reachable Assertion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| emqx cocoamqtt | < 2.2.2 |
CPE
Remediation
| |
| apple iphone os | All versions |
CPE
Remediation
| |
| apple macos | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 7, 2026 | Initial Analysis | [email protected] |
| Apr 2, 2026 | New CVE Received | [email protected] |