CVE-2026-30867: 
Swift vulnerability analysis and mitigation

CVE-2026-30867 is a Denial of Service vulnerability in CocoaMQTT, a MQTT 5.0 client library for iOS, macOS, and tvOS written in Swift, caused by a reachable assertion in PUBLISH packet parsing. Prior to version 2.2.2, a malicious or compromised MQTT broker can send a specially crafted 4-byte malformed payload that causes the application to crash immediately upon receipt. The vulnerability was disclosed on April 2, 2026, and patched in version 2.2.2 released March 5, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) per NVD, or 5.7 (Moderate) per the GitHub Security Advisory (GitHub Advisory).

The root cause is a reachable assertion (CWE-617) in Source/FramePublish.swift during PUBLISH packet Variable Header parsing. When the library reads the first two bytes to determine topicLength and that value is 0 (e.g., bytes 0x00 0x00), the variable pos evaluates to 2, causing the slice expression bytes[2...(2-1)] — i.e., bytes[2...1] — to be evaluated. Swift's ClosedRange operator requires the lower bound to be ≤ the upper bound; since 2 > 1, Swift triggers a fatal runtime trap (Fatal error: Range requires lowerBound <= upperBound), immediately crashing the host application. An attacker with low privileges (write access to a shared MQTT topic) can publish this 4-byte malformed payload with the RETAIN flag set, causing the broker to persist it and automatically deliver it to any vulnerable client that subscribes to that topic (GitHub Advisory, Fix PR #659).

Successful exploitation results in a persistent Denial of Service (DoS) affecting availability only — there is no confidentiality or integrity impact. The application crashes instantly in the background before the user can interact with it, and because the malformed payload is retained by the MQTT broker, every subsequent connection and subscription attempt by a vulnerable client triggers another crash, effectively "bricking" the mobile or desktop application until the retained message is manually removed from the broker database. This affects iOS, macOS, and tvOS applications using CocoaMQTT versions prior to 2.2.2 (GitHub Advisory).

A proof-of-concept exploit sequence is publicly documented in the GitHub Security Advisory, describing the exact 4-byte malformed payload and attack steps with high confidence. The attack requires only low privileges (the ability to publish to a shared MQTT topic) and no user interaction beyond the client connecting and subscribing. There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.043% (0.000430), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Gain broker publish access: Obtain credentials or access to publish messages on a shared MQTT topic that vulnerable clients subscribe to. This requires only low-privilege access to the broker.
2. Craft the malformed payload: Construct a 4-byte MQTT PUBLISH packet where the Topic Length field is set to 0x00 0x00 (zero), followed by two arbitrary payload bytes (e.g., [0x00, 0x00, 0x41, 0x41]). The fixed header byte should indicate a PUBLISH frame type.
3. Publish with RETAIN flag: Publish the malformed packet to the target shared topic with the RETAIN flag set to true. The MQTT broker will persist this payload in its retained message store.
4. Wait for victim connection: Any vulnerable CocoaMQTT client (version < 2.2.2) that connects to the broker and subscribes to the poisoned topic will automatically receive the retained malformed packet.
5. Trigger persistent crash: Upon receipt, the library attempts to slice bytes[2...1], triggering Swift's fatal runtime trap and immediately crashing the host application. The crash recurs on every reconnect/resubscribe until the retained message is manually purged from the broker (GitHub Advisory, Fix PR #659).

• Logs: Application crash logs on iOS/macOS/tvOS showing Fatal error: Range requires lowerBound <= upperBound originating from FramePublish.swift; crash reports in Xcode Organizer or device console referencing CocoaMQTT's PUBLISH frame parsing.
• Network: MQTT PUBLISH packets received on subscribed topics with a 2-byte Topic Length field of 0x00 0x00 (zero-length topic); retained messages on broker topics that consistently cause client crashes upon subscription.
• Broker: Presence of a retained message on a shared topic with a 4-byte payload beginning with 0x00 0x00; unexpected retained messages on topics that should not have retained content.
• Process: Repeated, immediate application termination (crash loop) of an iOS/macOS/tvOS app using CocoaMQTT immediately after connecting and subscribing to a specific topic, before any user interaction occurs (GitHub Advisory).

The primary remediation is to upgrade CocoaMQTT to version 2.2.2 or later, which adds strict bounds checks in FramePublish.swift, rejects PUBLISH packets with zero-length topics (for MQTT 3.1.1), and converts parse/protocol errors into safe socket disconnections rather than fatal traps (CocoaMQTT Release 2.2.2, Fix PR #659). As a workaround prior to upgrading, MQTT broker administrators should audit and remove any suspicious retained messages with zero-length topic payloads from the broker database, and restrict publish access to shared topics to trusted clients only. Ensuring MQTT connections are made exclusively to trusted, controlled broker instances also reduces exposure to this attack vector.

The vulnerability was reported to the CocoaMQTT maintainers by security researcher "t5uki" (also referenced as "tsuki") via email, and the fix was developed and merged by maintainer hjianbo (GitHub Advisory, Fix PR #659). Coverage appeared on vulnerability tracking platforms including CVEFeed, VulDB, and INCIBE-CERT shortly after disclosure. No significant broader industry commentary or social media discussion has been identified beyond standard vulnerability database aggregation.