A flaw in the tinyMQTT broker causes it to leave a TCP socket open after responding with a CONNACK return code 0x02 for a CONNECT packet that has a zero‑length Client ID and sets CleanSession to 0. The resulting open socket remains attached to the broker process's file descriptor table, creating a resource leak that grows with each malformed CONNECT attempt. The weakness is classified as erroneous resource handling and failure to release connections, which can be exploited to exhaust server file descriptors and memory, ultimately leading to service interruption.

The vulnerable code is present in tinyMQTT versions that include commit 6226ade15bd4f97be2d196352e64dd10937c1962, dated 18 February 2024. Any build that has not incorporated the follow‑up patch that closes the connection after a 0x02 CONNACK is affected. The project is hosted on GitHub and does not list a formal vendor; it is an open‑source broker distribution.

Based on the description, it is inferred that the issue can be triggered remotely by an authenticated or unauthenticated client simply by sending the malformed CONNECT packet over the network. No special privileges are required. Because each request keeps a socket open, an attacker can repeatedly send them to accumulate a large number of file descriptors, consuming memory and potentially causing the broker to fail or crash. The CVSS score is 7.5, indicating a medium‑to‑high impact. EPSS data is not available, and the vulnerability is not listed in CISA KEV. The exploit path is straightforward: the broker always replies with a standard CONNACK, meaning the attacker can continue to send malformed packets until resources are exhausted.