MQTT before 3.4.6 and 4.0.x before 4.0.5 allows specifically crafted MQTT packets to crash the application, making a DoS attack feasible with very little bandwidth.
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-10523.json"