CVE-2026-30867

{
  "id": "CVE-2026-30867",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-02T14:16:28.407",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "CocoaMQTT is a MQTT 5.0 client library for iOS and macOS written in Swift. Prior to version 2.2.2, a vulnerability exists in the packet parsing logic of CocoaMQTT that allows an attacker (or a compromised/malicious MQTT broker) to remotely crash the host iOS/macOS/tvOS application. If an attacker publishes the 4-byte malformed payload to a shared topic with the RETAIN flag set to true, the MQTT broker will persist the payload. Any time a vulnerable client connects and subscribes to that topic, the broker will automatically push the malformed packet. The app will instantly crash in the background before the user can even interact with it. This effectively \"bricks\" the mobile application (a persistent DoS) until the retained message is manually wiped from the broker database. This issue has been patched in version 2.2.2."
    },
    {
      "lang": "es",
      "value": "CocoaMQTT es una biblioteca cliente MQTT 5.0 para iOS y macOS escrita en Swift. Antes de la versión 2.2.2, existe una vulnerabilidad en la lógica de análisis de paquetes de CocoaMQTT que permite a un atacante (o un bróker MQTT comprometido/malicioso) bloquear remotamente la aplicación anfitriona de iOS/macOS/tvOS. Si un atacante publica la carga útil malformada de 4 bytes en un tema compartido con la bandera RETAIN establecida en verdadero, el bróker MQTT persistirá la carga útil. Cada vez que un cliente vulnerable se conecta y se suscribe a ese tema, el bróker enviará automáticamente el paquete malformado. La aplicación se bloqueará instantáneamente en segundo plano antes de que el usuario pueda interactuar con ella. Esto efectivamente ’bloquea’ la aplicación móvil (un DoS persistente) hasta que el mensaje retenido sea borrado manualmente de la base de datos del bróker. Este problema ha sido parcheado en la versión 2.2.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "emqx",
          "product": "CocoaMQTT",
          "versions": [
            {
              "version": "< 2.2.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
          "baseScore": 5.7,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 3.6
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-02T16:18:50.452760Z",
          "id": "CVE-2026-30867",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-617"
        }
      ]
    }
  ],
  "configurations": [
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:emqx:cocoamqtt:*:*:*:*:*:swift:*:*",
              "versionEndExcluding": "2.2.2",
              "matchCriteriaId": "CB8EC6A7-A8BA-4184-8097-74086252F0BF"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B5415705-33E5-46D5-8E4D-9EBADC8C5705"
            },
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/emqx/CocoaMQTT/commit/010bca6f61b97d726252f61641d331a2bf82b338",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/emqx/CocoaMQTT/pull/659",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://github.com/emqx/CocoaMQTT/releases/tag/2.2.2",
      "source": "[email protected]",
      "tags": [
        "Release Notes"
      ]
    },
    {
      "url": "https://github.com/emqx/CocoaMQTT/security/advisories/GHSA-r3fr-7m74-q7g2",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}