CVE-2026-13491: Denial of Service in 78 xiaozhi-esp32
A vulnerability was detected in 78 xiaozhi-esp32 up to 2.2.6. This vulnerability affects the function Application::GetInstance of the file main/protocols/mqtt_protocol.cc of the component MQTT Goodbye Handler. Performing a manipulation of the argument session_id results in denial of service. The attack is possible to be carried out remotely. The complexity of an attack is rather high. It is stated that the exploitability is difficult. The exploit is now public and may be used. The patch is named e182471f8c5a22434346bd98da34d3b66c8c8b3e. It is recommended to apply a patch to fix this issue.
AI Analysis
Technical Summary
This vulnerability affects the 78 xiaozhi-esp32 product up to version 2.2.6 in the Application::GetInstance function of the MQTT Goodbye Handler component (file main/protocols/mqtt_protocol.cc). By manipulating the session_id argument remotely, an attacker can cause a denial of service condition. The attack complexity is high, and no privileges or user interaction are needed to exploit it. Although the exploit is public, it is considered difficult to execute. A patch exists (commit e182471f8c5a22434346bd98da34d3b66c8c8b3e) and should be applied to remediate the vulnerability.
Potential Impact
Successful exploitation results in denial of service, causing the affected application to become unavailable or unresponsive. The vulnerability can be exploited remotely without authentication or user interaction. The CVSS 4.0 base score is 6.3 (medium severity), reflecting the high attack complexity and lack of privilege requirements.
Mitigation Recommendations
A patch identified by commit e182471f8c5a22434346bd98da34d3b66c8c8b3e is available and recommended to fix this issue. Users should apply this patch to versions 2.2.0 through 2.2.6 of 78 xiaozhi-esp32 to remediate the vulnerability. No other official remediation level is stated, so applying the patch is the advised course of action.
CVE-2026-13491: Denial of Service in 78 xiaozhi-esp32
Description
A vulnerability was detected in 78 xiaozhi-esp32 up to 2.2.6. This vulnerability affects the function Application::GetInstance of the file main/protocols/mqtt_protocol.cc of the component MQTT Goodbye Handler. Performing a manipulation of the argument session_id results in denial of service. The attack is possible to be carried out remotely. The complexity of an attack is rather high. It is stated that the exploitability is difficult. The exploit is now public and may be used. The patch is named e182471f8c5a22434346bd98da34d3b66c8c8b3e. It is recommended to apply a patch to fix this issue.
CVSS v4.0
Score 6.3medium
Affected software
pkg:github/78/xiaozhi-esp32cpe:2.3:a:78:xiaozhi-esp32:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects the 78 xiaozhi-esp32 product up to version 2.2.6 in the Application::GetInstance function of the MQTT Goodbye Handler component (file main/protocols/mqtt_protocol.cc). By manipulating the session_id argument remotely, an attacker can cause a denial of service condition. The attack complexity is high, and no privileges or user interaction are needed to exploit it. Although the exploit is public, it is considered difficult to execute. A patch exists (commit e182471f8c5a22434346bd98da34d3b66c8c8b3e) and should be applied to remediate the vulnerability.
Potential Impact
Successful exploitation results in denial of service, causing the affected application to become unavailable or unresponsive. The vulnerability can be exploited remotely without authentication or user interaction. The CVSS 4.0 base score is 6.3 (medium severity), reflecting the high attack complexity and lack of privilege requirements.
Mitigation Recommendations
A patch identified by commit e182471f8c5a22434346bd98da34d3b66c8c8b3e is available and recommended to fix this issue. Users should apply this patch to versions 2.2.0 through 2.2.6 of 78 xiaozhi-esp32 to remediate the vulnerability. No other official remediation level is stated, so applying the patch is the advised course of action.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-06-27T16:04:15.073Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a41073b27e9c79719dbb8d1
Added to database: 06/28/2026, 11:36:27 UTC
Last enriched: 07/05/2026, 23:27:03 UTC
Last updated: 08/11/2026, 12:41:08 UTC
Views: 147
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.