Skip to content

Release 0.18.1

Latest
Latest

Choose a tag to compare

View all tags
@andsel andsel released this 01 Aug 13:36
· 37 commits to main since this release
v0.18.1
e8ce833

This is a security and stability patch release. All fixes address denial-of-service vectors, resource exhaustion, and correctness bugs found in the 0.18.x line. Upgrading is strongly recommended.

Security fixes

  • Pattern ACL: wildcard injection via client ID/username — A crafted client ID or username containing MQTT wildcards could be injected into pattern-ACL rules, bypassing access controls. The pattern substitution is now sanitized before evaluation.
  • Pattern ACL: null username crash — A missing (null) username during ACL substitution could be exploited to crash the broker remotely. A null guard prevents the substitution from being attempted. (#963)
  • Shared subscription DoS — A malformed $share subscription string was parsed before being validated, allowing a remote client to trigger a parse error. Malformed shared subscriptions are now rejected before parsing. (#963)
  • Session event loop crash — An unhandled exception thrown by a session command could terminate the per-client event loop, disconnecting the client and preventing reconnection. The loop now catches and logs command errors without exiting. (#957)

Resource and reliability fixes

  • Session queue depth limit — Per-session queues for durable subscribers had no upper bound. A fast publisher sending to a topic with a slow subscriber could exhaust heap. A configurable maximum depth is now enforced.
  • Topic depth guard — No maximum nesting depth was enforced on topic strings. Excessively deep topics are now rejected at publish, subscribe, and SubscriptionDirectory entry points, preventing stack overflow and excessive processing.
  • Periodic expiration task isolation — An exception thrown while expiring one session or message could silently cancel the entire expiration sweep, causing resource leaks. Each entity is now processed in isolation so one failure cannot disable all expirations. (#959)
  • H2 queue metadata namespace collision — The H2-backed durable queue used an unscoped metadata key, meaning two clients with IDs that hash identically could corrupt each other's queued messages. Keys are now namespaced per client ID. (#964)

Correctness fixes

  • Last Will topic authorization — The broker published a Last Will message without checking whether the connecting client had write permission on the Last Will topic. The authorization check is now performed at connection time.
  • Strict authorizator/authenticator class loading — If a configured authorizator_class or authenticator_class could not be loaded, the broker silently fell back to a fully permissive implementation. The broker now fails to start instead, preventing accidental open access. (#967)

Upgrade notes

  • The session queue depth limit is enforced with a default maximum. If you have subscribers that legitimately buffer large volumes of in-flight messages, review the new queue depth configuration option before upgrading.
  • The strict class-loading behavior (#967) is a breaking change for misconfigured deployments: brokers that previously started with a bad authorizator_class value will now refuse to start. Verify your configuration before rolling out.
Assets 3
Loading