CVE-2026-30867

{"id": "CVE-2026-30867", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30867", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-02T16:18:50.452760Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "emqx", "product": "CocoaMQTT", "versions": [{"status": "affected", "version": "< 2.2.2"}]}]}], "published": "2026-04-02T14:16:28.407", "references": [{"url": "https://github.com/emqx/CocoaMQTT/commit/010bca6f61b97d726252f61641d331a2bf82b338", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/emqx/CocoaMQTT/pull/659", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/emqx/CocoaMQTT/releases/tag/2.2.2", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/emqx/CocoaMQTT/security/advisories/GHSA-r3fr-7m74-q7g2", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-617"}]}], "descriptions": [{"lang": "en", "value": "CocoaMQTT is a MQTT 5.0 client library for iOS and macOS written in Swift. Prior to version 2.2.2, a vulnerability exists in the packet parsing logic of CocoaMQTT that allows an attacker (or a compromised/malicious MQTT broker) to remotely crash the host iOS/macOS/tvOS application. If an attacker publishes the 4-byte malformed payload to a shared topic with the RETAIN flag set to true, the MQTT broker will persist the payload. Any time a vulnerable client connects and subscribes to that topic, the broker will automatically push the malformed packet. The app will instantly crash in the background before the user can even interact with it. This effectively \"bricks\" the mobile application (a persistent DoS) until the retained message is manually wiped from the broker database. This issue has been patched in version 2.2.2."}, {"lang": "es", "value": "CocoaMQTT es una biblioteca cliente MQTT 5.0 para iOS y macOS escrita en Swift. Antes de la versi\u00f3n 2.2.2, existe una vulnerabilidad en la l\u00f3gica de an\u00e1lisis de paquetes de CocoaMQTT que permite a un atacante (o un br\u00f3ker MQTT comprometido/malicioso) bloquear remotamente la aplicaci\u00f3n anfitriona de iOS/macOS/tvOS. Si un atacante publica la carga \u00fatil malformada de 4 bytes en un tema compartido con la bandera RETAIN establecida en verdadero, el br\u00f3ker MQTT persistir\u00e1 la carga \u00fatil. Cada vez que un cliente vulnerable se conecta y se suscribe a ese tema, el br\u00f3ker enviar\u00e1 autom\u00e1ticamente el paquete malformado. La aplicaci\u00f3n se bloquear\u00e1 instant\u00e1neamente en segundo plano antes de que el usuario pueda interactuar con ella. Esto efectivamente \u2019bloquea\u2019 la aplicaci\u00f3n m\u00f3vil (un DoS persistente) hasta que el mensaje retenido sea borrado manualmente de la base de datos del br\u00f3ker. Este problema ha sido parcheado en la versi\u00f3n 2.2.2."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:emqx:cocoamqtt:*:*:*:*:*:swift:*:*", "vulnerable": true, "matchCriteriaId": "CB8EC6A7-A8BA-4184-8097-74086252F0BF", "versionEndExcluding": "2.2.2"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B5415705-33E5-46D5-8E4D-9EBADC8C5705"}, {"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security-advisories@github.com"}