CVE-2024-36856

What it actually does

The flaw stems from improper management of MQTT session resources, allowing an unbounded number of long-lived publish/subscribe sessions to accumulate and exhaust system memory until the broker daemon crashes.

Why it matters to the business

MQTT message brokers become unavailable, interrupting real-time messaging and device communications that depend on the service and causing operational downtime.

How an attack unfolds

An unauthenticated remote attacker repeatedly opens and maintains a large volume of malicious publish/subscribe sessions over the network; because the broker fails to release or limit session memory, resident memory grows until the process terminates.

How to fix it

Upgrade rmqtt/rmqtt to the commit c5c681e849c24189d4635acc9d5a66314835d2e9 or later; if a packaged release is unavailable, rebuild from the patched source and restart the broker.

How to confirm the fix worked

Confirm the running binary or source tree contains commit c5c681e849c24189d4635acc9d5a66314835d2e9; monitor broker memory usage under simulated high-session load to verify resource limits are enforced.

Typical attack path

1. Locate an exposed RMQTT broker instance accepting unauthenticated connections
2. Establish thousands of long-lived MQTT sessions with crafted publish or subscribe topics
3. Continue sending minimal keep-alive traffic to prevent session timeout
4. Observe progressive memory growth until the broker process crashes or becomes unresponsive

How to detect it

Review broker logs and operating-system process metrics for sudden spikes in open MQTT sessions or resident memory; correlate with external connection attempts that lack corresponding legitimate client identifiers.

What your security team should do

• Immediately upgrade all rmqtt/rmqtt deployments to the patched commit
• Place network access controls in front of MQTT brokers to restrict unauthenticated connections
• Implement connection and session rate limiting at the load-balancer or broker configuration level
• Add memory-usage and session-count alerts to existing monitoring