The sol broker, as of commit 373d848 dated 2024-12-12, improperly manages resources when processing malformed or duplicate CONNECT packets. Specifically, when clients send invalid CONNECT packets due to repeated attempts or failed authentication, the server may silently drop the connection or send a CONNACK response but fail to close the session or deallocate internal resources. This results in resource leakage, allowing an attacker to create many half-open connections that consume memory and file descriptors indefinitely, which can exhaust system resources and cause a denial of service condition.

The vulnerability allows an unauthenticated remote attacker to cause a denial of service by exhausting system memory and file descriptors through resource leakage. This can trigger the Linux Out-Of-Memory (OOM) killer, potentially impacting availability of the broker service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, monitoring for abnormal connection patterns and limiting connection attempts may help mitigate impact.