CVE-2026-13491

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-13491
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13491.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-13491
Published
2026-06-28T11:15:10.481Z
Modified
2026-07-15T01:49:14.599282007Z
Severity
  • 2.9 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
78 xiaozhi-esp32 MQTT Goodbye mqtt_protocol.cc GetInstance denial of service
Details

A vulnerability was detected in 78 xiaozhi-esp32 up to 2.2.6. This vulnerability affects the function Application::GetInstance of the file main/protocols/mqttprotocol.cc of the component MQTT Goodbye Handler. Performing a manipulation of the argument sessionid results in denial of service. The attack is possible to be carried out remotely. The complexity of an attack is rather high. It is stated that the exploitability is difficult. The exploit is now public and may be used. The patch is named e182471f8c5a22434346bd98da34d3b66c8c8b3e. It is recommended to apply a patch to fix this issue.

Database specific 
{
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/13xxx/CVE-2026-13491.json",
    "cwe_ids": [
        "CWE-404"
    ],
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "2.2.0"
                },
                {
                    "last_affected": "2.2.0"
                },
                {
                    "introduced": "2.2.1"
                },
                {
                    "last_affected": "2.2.1"
                },
                {
                    "introduced": "2.2.5"
                },
                {
                    "last_affected": "2.2.5"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/78/xiaozhi-esp32

Affected ranges

Type
GIT
Repo
https://github.com/78/xiaozhi-esp32
Events
Introduced
37110a9d05a199efeff6ca3bb590427a354d0df2
Fixed
e182471f8c5a22434346bd98da34d3b66c8c8b3e
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "2.2.2"
        },
        {
            "last_affected": "2.2.2"
        },
        {
            "introduced": "2.2.3"
        },
        {
            "last_affected": "2.2.3"
        },
        {
            "introduced": "2.2.4"
        },
        {
            "last_affected": "2.2.4"
        },
        {
            "introduced": "2.2.6"
        },
        {
            "last_affected": "2.2.6"
        }
    ]
}

Affected versions

2.*
2.2.2
2.2.3
2.2.4
2.2.6
v2.*
v2.2.2
v2.2.3
v2.2.4
v2.2.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-13491.json"