CVE-2026-63341

{
  "etk_id": "ETK-2026-3125",
  "cve_id": "CVE-2026-63341",
  "display_id": "CVE-2026-63341",
  "ghsa_id": "GHSA-xxqp-5qx8-gj5q",
  "euvd_id": "EUVD-2026-114567",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Uncaught topic-processing exception in Aedes MQTT broker",
  "summary": "Aedes versions before 1.1.1 can terminate when processing MQTT messages with excessively complex topic structures. An attacker who can establish an MQTT session may disconnect clients and prevent new connections until the broker is restarted.",
  "mitigation": "Upgrade the aedes package to version 1.1.1 or later. Until upgraded, restrict MQTT session access to trusted clients and restart affected broker processes if they terminate.",
  "vendor": "moscajs",
  "product": "aedes",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 1.1.0"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.1.1"
      ],
      "package_name": "aedes",
      "purl": "pkg:npm/aedes"
    }
  ],
  "cwes": [
    248
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 20.3036182,
  "t0_at": "2026-10-30T22:09:50.280000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-30T22:09:50.280000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-30T22:09:50.280000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63341"
    }
  }
}