In a recent commit to the open-source messaging broker "sol" the server fails to release resources properly when processing malformed or duplicate CONNECT packets. When a client sends an invalid CONNECT, the broker may return a CONNACK or silently drop the connection while still keeping session resources alive. This bug allows an attacker to open many half‑open connections that consume memory and file descriptors, potentially invoking the Linux OOM killer and rendering the broker unavailable.

No specific vendor or product name is listed in the CVE data; the affected component is the open‑source broker named "sol". Users running versions that include the vulnerable commit without any applied patch or mitigation are at risk.

The CVSS score is not provided and the EPSS score is unavailable, so the quantitative risk assessment is uncertain. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote trouble from unauthenticated or authenticated clients that can send repeated or malformed CONNECT packets to the broker, creating a denial of service through uncontrolled resource consumption.