Threats affecting pkg:github/emqx/CocoaMQTT

CVE-2026-30867 is a reachable assertion vulnerability in the CocoaMQTT client library for iOS and macOS prior to version 2.2.2. The flaw exists in the packet parsing logic, where a 4-byte malformed payload with the RETAIN flag set can be published to a shared topic on an MQTT broker. When a vulnerable client subscribes to this topic, the broker pushes the malformed packet, causing the client application to crash immediately in the background. This results in a persistent denial-of-service condition until the retained message is removed from the broker. The issue has been patched in CocoaMQTT version 2.2.2.