eclipse-paho/paho.golang

paho.ReadPacket Parket size should be limited to `Maximum Packet Size` (if set)

Open

#336 opened on May 30, 2026

View on GitHub
 (1 comment) (0 reactions) (0 assignees)Go (115 forks)auto 404
enhancementgood first issuehelp wanted

Repository metrics

Stars
 (437 stars)
PR merge metrics
 (PR metrics pending)

Description

Currently a hostile broker could (potentially) cause a client to run out of memory by sending a lot of 256MB messages. I feel the risk is fairly low because the attacker would need to control the broker, and be able to deliver messages quickly enough to overwhelm the client.

The CONNECT packet can include a Maximum Packet Size property. If this has been set then, ideally, paho.ReadPacket should reject any packets larger than this (ideally as soon as it receives the packet size so no memory is allocated). As per the spec, upon receiving an oversize packet, "the Client uses DISCONNECT with Reason Code 0x95 (Packet too large), as described in section 4.13".

The cleanest way of implementing this is probably to add a paho.ReadPacketN (or similar) that takes the reader and a maximum size. The existing function can then just call the new one (ReadPacket is also used when reading from disk).

Contributor guide

Research direction
Inspect the CONNECT packet handling and add a ReadPacketN function that enforces Maximum Packet Size. Oversized packets should be rejected with DISCONNECT Reason Code 0x95 as per spec.
Tech stack
go
Domain
backend
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GoGit
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
75