Description

In sol commit 373d848 (2024-12-12), the broker does not fully release resources when handling malformed or duplicate CONNECT packets. When clients send invalid CONNECT packets - either due to repeated attempts or failed authentication - the server may silently drop the connection or send a CONNACK but fail to close the session or deallocate internal resources. This behavior allows an attacker to create numerous half-open connections that consume memory and file descriptors indefinitely, potentially triggering the Linux OOM killer and causing a denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-07T19:17:33.580Z",
  "pubdate": "2026-08-07T19:17:33.580Z",
  "executiveSummary": "A resource exhaustion vulnerability exists in the sol broker, specifically identified in commit 373d848 dated 2024-12-12. The vulnerability stems from improper resource management when handling malformed or duplicate CONNECT packets sent by clients. When clients transmit invalid CONNECT packets due to repeated attempts or failed authentication, the server may silently drop the connection or transmit a CONNACK packet while failing to properly close the associated session or deallocate internal resources. This flaw allows an unauthenticated remote attacker to create numerous half-open connections that persistently consume memory and file descriptors. The direct impact of this behavior is a denial of service condition, which can exhaust system resources and potentially trigger the Linux Out-Of-Memory (OOM) killer, resulting in a crash of the host system or service disruption. Exploitation requires network access to the broker and involves sending crafted or repeated invalid connection payloads to accumulate dangling resources indefinitely without requiring prior authentication or privileged access.",
  "technicalDetails": "The vulnerability resides within the session and connection management logic of the sol broker, specifically how it processes incoming CONNECT packets. The root cause is an inadequate resource cleanup routine when parsing and handling malformed or duplicate connection payloads. During normal protocol execution, the broker allocates memory structures and file descriptors to track client sessions upon receiving a CONNECT packet. However, when an invalid CONNECT packet is processed—triggered either by protocol malformation, duplicate connection attempts over an existing channel, or authentication failures—the state machine fails to cleanly tear down the session context.\nSpecifically, the server may opt to silently drop the underlying network connection or send a negative CONNACK response, yet it omits the necessary deallocation procedures for internal tracking structures. This leaves orphaned session states and half-open connection handles lingering in the broker's memory space. Because these resources are neither timed out nor reclaimed, an attacker can systematically scale this behavior by scripting automated clients to continuously inundate the broker with malformed or duplicate CONNECT packets.\nThe attack flow proceeds as follows: First, the attacker establishes multiple TCP or network connections to the sol broker. Second, the attacker transmits invalid, malformed, or duplicate CONNECT payloads across these connections. Third, the broker encounters the parsing or authentication failure, issues a CONNACK or drops the socket, but retains the internal session allocation and associated file descriptors due to the omission in commit 373d848. Fourth, by repeating this process at a high frequency, the attacker continuously consumes available file descriptors and RAM. Eventually, this unabated resource accumulation exhausts system-wide resources, leading to performance degradation, application unresponsiveness, and the potential termination of the broker process by the Linux OOM killer."
}