CVE-2020-13849: 
NixOS vulnerability analysis and mitigation

The MQTT protocol 3.1.1 contains a vulnerability (CVE-2020-13849) where the server is required to set a timeout value of 1.5 times the Keep-Alive value specified by a client, which allows remote attackers to cause a denial of service. This vulnerability was disclosed on June 4, 2020 (NVD).

The vulnerability exists in the MQTT protocol specification version 3.1.1, specifically in how the server handles the Keep-Alive timeout value. According to the protocol specification, servers must set their timeout value to 1.5 times the Keep-Alive value that is specified by the connecting client. This requirement in the protocol specification can be exploited by attackers (MITRE).

The vulnerability can lead to a denial of service condition on MQTT servers. By manipulating the Keep-Alive values, remote attackers can potentially cause the server to maintain connections longer than intended, potentially exhausting server resources (NVD).

The vulnerability can be exploited remotely by attackers who can connect to the MQTT server. The exploitation requires the ability to establish an MQTT connection and specify Keep-Alive values (NVD).