CVE-2025-63235

Name of the Vulnerable Software and Affected Versions sol (affected versions not specified)

Description The broker fails to fully release resources when processing malformed or duplicate CONNECT packets. If clients send invalid CONNECT packets due to failed authentication or repeated attempts, the server may drop the connection or send a CONNACK without closing the session or deallocating internal resources. This allows for the creation of numerous half-open connections that consume memory and file descriptors, which can trigger the Linux OOM (Out of Memory) killer—a kernel feature that terminates processes to free up memory—resulting in a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.