Low-severity hardening and compliance fixes - #567

Merged

embhorn merged 24 commits into

wolfSSL:masterfrom

aidangarske:fenrir-critical-high-fixes

Aug 12, 2026

Commits on Aug 12, 2026

F-7630 - Reject NULL gwAddr destination in MQTT-SN GWINFO decode
aidangarske
committed
e3d4e4d
F-7661 - Retain inbound QoS 2 dedup state across broker session reconnect
aidangarske
committed
f02cced
F-7666 - Reject CONNECT Receive Maximum of 0 as a protocol error
aidangarske
committed
545115d
F-7668 - Default v5 CONNECT Session Expiry to 0 regardless of Clean Start
aidangarske
committed
6c0fde1
F-7669 - Create orphan session for zero-subscription clients with nonzero expiry
aidangarske
committed
3baf6ae
F-7670 - Sweep and expire orphan sessions past their Session Expiry deadline
aidangarske
committed
28ab8dd
F-7671 - Apply DISCONNECT Session Expiry Interval and reject illegal increase
aidangarske
committed
ebabb34
F-7672 - Honor SUBSCRIBE Retain Handling option before retained delivery
aidangarske
committed
4aac806
F-7673 - Preserve v5 PUBLISH properties through the outbound queue
aidangarske
committed
77ccc3b
F-7674 - Route retained and Will delivery through the tracked outbound queue
aidangarske
committed
9a75f3f
F-7675 - Reject Will-bearing CONNECT when Will support is not compiled in
aidangarske
committed
edb89a0
F-7676 - Schedule pending Will publish at the earlier of delay or session end
aidangarske
committed
8d839b2
F-7677 - Preserve the full negotiated Will Delay Interval instead of clamping
aidangarske
committed
80d6a5d
F-7681 - Close connection on malformed PUBACK or PUBCOMP decode
aidangarske
committed
69af494
F-7678 - Reject CONNECT carrying an unsupported Authentication Method
aidangarske
committed
598118e
F-7664 - Scope duplicate Subscription Identifier exemption to PUBLISH only
aidangarske
committed
81d106f
F-7665 - Enforce a distinct allow-list for v5 Will Properties
aidangarske
committed
5cbdc85
F-7663 - Make decode-side UTF-8 well-formedness validation mandatory
aidangarske
committed
77c07de
F-7656 - Validate PUBACK/PUBREC/PUBREL/PUBCOMP Reason Code before encoding
aidangarske
committed
e378990
F-7679 - Reject Authentication Data without Authentication Method in CONNECT
aidangarske
committed
9a3a347
F-7667 - Reject CONNECT Maximum Packet Size of 0 as a protocol error
aidangarske
committed
12f9636
F-7657 - Enforce client-side Receive Maximum flow control quota
aidangarske
committed
4232b02
F-7662 - Disconnect client on malformed or protocol-invalid received data
aidangarske
committed
05a9ceb
F-7680 - Enforce client-side Topic Alias Maximum on outbound PUBLISH
aidangarske
committed
d8d864a

Navigation Menu

Uh oh!

Low-severity hardening and compliance fixes - #567

Low-severity hardening and compliance fixes#567
embhorn merged 24 commits into
wolfSSL:masterfrom
aidangarske:fenrir-critical-high-fixes

Commits on Aug 12, 2026

F-7630 - Reject NULL gwAddr destination in MQTT-SN GWINFO decode

F-7661 - Retain inbound QoS 2 dedup state across broker session reconnect

F-7666 - Reject CONNECT Receive Maximum of 0 as a protocol error

F-7668 - Default v5 CONNECT Session Expiry to 0 regardless of Clean Start

F-7669 - Create orphan session for zero-subscription clients with nonzero expiry

F-7670 - Sweep and expire orphan sessions past their Session Expiry deadline

F-7671 - Apply DISCONNECT Session Expiry Interval and reject illegal increase

F-7672 - Honor SUBSCRIBE Retain Handling option before retained delivery

F-7673 - Preserve v5 PUBLISH properties through the outbound queue

F-7674 - Route retained and Will delivery through the tracked outbound queue

F-7675 - Reject Will-bearing CONNECT when Will support is not compiled in

F-7676 - Schedule pending Will publish at the earlier of delay or session end

F-7677 - Preserve the full negotiated Will Delay Interval instead of clamping

F-7681 - Close connection on malformed PUBACK or PUBCOMP decode

F-7678 - Reject CONNECT carrying an unsupported Authentication Method

F-7664 - Scope duplicate Subscription Identifier exemption to PUBLISH only

F-7665 - Enforce a distinct allow-list for v5 Will Properties

F-7663 - Make decode-side UTF-8 well-formedness validation mandatory

F-7656 - Validate PUBACK/PUBREC/PUBREL/PUBCOMP Reason Code before encoding

F-7679 - Reject Authentication Data without Authentication Method in CONNECT

F-7667 - Reject CONNECT Maximum Packet Size of 0 as a protocol error

F-7657 - Enforce client-side Receive Maximum flow control quota

F-7662 - Disconnect client on malformed or protocol-invalid received data

F-7680 - Enforce client-side Topic Alias Maximum on outbound PUBLISH