CVE-2025-63235: Sol Broker DoS Vulnerability

CVE-2025-63235 Overview

CVE-2025-63235 is a resource exhaustion vulnerability in the sol MQTT broker at commit 373d848 dated 2024-12-12. The broker fails to fully release resources when processing malformed or duplicate CONNECT packets. Invalid CONNECT attempts, including repeated submissions or failed authentication, cause the server to silently drop connections or return a CONNACK without closing the session or freeing internal resources. Attackers can exploit this behavior to accumulate half-open connections that consume memory and file descriptors. Sustained exploitation triggers the Linux out-of-memory (OOM) killer, resulting in denial of service. The weakness is classified under [CWE-400] Uncontrolled Resource Consumption.

Critical Impact
Unauthenticated remote attackers can exhaust broker memory and file descriptors, causing complete denial of service on the host process.

Affected Products

sol MQTT broker (project by codepr on GitHub)
Commit 373d848 (2024-12-12)
Deployments running unpatched builds from the affected commit

Discovery Timeline

2026-08-07 - CVE-2025-63235 published to NVD
2026-08-07 - Last updated in NVD database

Technical Details for CVE-2025-63235

Vulnerability Analysis

The sol broker implements the MQTT protocol and accepts client connections initiated with a CONNECT control packet. According to protocol semantics, the broker must validate the packet, respond with a CONNACK, and clean up any allocated state when the exchange fails. The affected commit does not enforce complete cleanup on failure paths.

When a client submits a malformed CONNECT packet or repeats a CONNECT on an existing session, the broker either drops the socket without deallocating session structures or transmits a CONNACK while leaving the session marked active. Each failed exchange leaves file descriptors open and heap allocations resident. Attackers issuing streams of invalid CONNECT packets accumulate half-open sessions until the process reaches system resource limits.

Root Cause

The root cause is missing resource release in the CONNECT handling code path. Error branches skip the deallocation logic that normal disconnect handlers execute, violating the cleanup contract for both socket state and session objects.

Attack Vector

Exploitation requires only network reachability to the broker's MQTT listener. No authentication or user interaction is needed. An attacker opens TCP connections and sends invalid or duplicate CONNECT packets in a loop, keeping each socket alive long enough for the broker to allocate but not release resources. See the GitHub CVE-2025-63235 details and the upstream issue report for reproduction notes.

The vulnerability manifests in the CONNECT packet handler. Refer to the linked references for source-level analysis; no verified proof-of-concept code is provided in the CVE record.

Detection Methods for CVE-2025-63235

Indicators of Compromise

Rapid growth in the broker process's open file descriptor count without a corresponding rise in authenticated client sessions
Repeated CONNECT packets from the same source IP with malformed fields or invalid client identifiers
Kernel log entries showing the OOM killer terminating the sol broker process
CONNACK responses in packet captures that are not followed by subscribe or publish activity

Detection Strategies

Instrument the broker host with process-level resource monitoring to alert on abnormal memory and descriptor growth
Deploy network sensors that parse MQTT traffic and count CONNECT-to-DISCONNECT ratios per source address
Correlate broker logs with connection counts to identify sessions that authenticate or fail without proper teardown

Monitoring Recommendations

Track /proc/<pid>/fd counts and RSS memory for the broker process at short intervals
Log every CONNECT and CONNACK exchange with source IP, client ID, and result code for retrospective analysis
Configure alerts on connection rate spikes from single sources exceeding normal client behavior baselines

How to Mitigate CVE-2025-63235

Immediate Actions Required

Restrict network access to the MQTT listener using firewall rules that permit only trusted client subnets
Place the broker behind a reverse proxy or MQTT-aware gateway that enforces rate limiting on CONNECT packets
Apply operating system limits with ulimit or systemd LimitNOFILE to bound the damage from resource exhaustion

Patch Information

No official patched release is referenced in the NVD entry for CVE-2025-63235. Operators should monitor the upstream sol repository for a fix that ensures full deallocation on CONNECT failure paths. Until a patch is published, consider migrating to a maintained MQTT broker.

Workarounds

Enforce per-source connection rate limits at the network layer using iptables or nftables limit rules
Deploy a fail2ban policy that bans source IPs generating repeated CONNECT failures
Run the broker under a process supervisor with automatic restart on OOM termination to reduce outage duration

bash

# Example nftables rule limiting new MQTT connections per source
nft add rule inet filter input tcp dport 1883 ct state new \
  meter mqtt_conn { ip saddr limit rate 10/minute } accept