Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities by 78
CVE-2026-13491 (GCVE-0-2026-13491)
Vulnerability from nvd – Published: 2026-06-28 11:15 – Updated: 2026-06-28 11:15 X_Open Source
VLAI
Title
78 xiaozhi-esp32 MQTT Goodbye mqtt_protocol.cc GetInstance denial of service
Summary
A vulnerability was detected in 78 xiaozhi-esp32 up to 2.2.6. This vulnerability affects the function Application::GetInstance of the file main/protocols/mqtt_protocol.cc of the component MQTT Goodbye Handler. Performing a manipulation of the argument session_id results in denial of service. The attack is possible to be carried out remotely. The complexity of an attack is rather high. It is stated that the exploitability is difficult. The exploit is now public and may be used. The patch is named e182471f8c5a22434346bd98da34d3b66c8c8b3e. It is recommended to apply a patch to fix this issue.
Severity
CWE
- CWE-404 - Denial of Service
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/374488 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/374488/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-13491 | third-party-advisory |
| https://vuldb.com/submit/838439 | third-party-advisory |
| https://github.com/78/xiaozhi-esp32/issues/2022 | exploitissue-tracking |
| https://github.com/78/xiaozhi-esp32/pull/2023 | issue-trackingpatch |
| https://github.com/78/xiaozhi-esp32/commit/e18247… | patch |
| https://github.com/78/xiaozhi-esp32/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| 78 | xiaozhi-esp32 |
Affected:
2.2.0
Affected: 2.2.1 Affected: 2.2.2 Affected: 2.2.3 Affected: 2.2.4 Affected: 2.2.5 Affected: 2.2.6 cpe:2.3:a:78:xiaozhi-esp32:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:78:xiaozhi-esp32:*:*:*:*:*:*:*:*"
],
"modules": [
"MQTT Goodbye Handler"
],
"product": "xiaozhi-esp32",
"vendor": "78",
"versions": [
{
"status": "affected",
"version": "2.2.0"
},
{
"status": "affected",
"version": "2.2.1"
},
{
"status": "affected",
"version": "2.2.2"
},
{
"status": "affected",
"version": "2.2.3"
},
{
"status": "affected",
"version": "2.2.4"
},
{
"status": "affected",
"version": "2.2.5"
},
{
"status": "affected",
"version": "2.2.6"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "dem0000 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in 78 xiaozhi-esp32 up to 2.2.6. This vulnerability affects the function Application::GetInstance of the file main/protocols/mqtt_protocol.cc of the component MQTT Goodbye Handler. Performing a manipulation of the argument session_id results in denial of service. The attack is possible to be carried out remotely. The complexity of an attack is rather high. It is stated that the exploitability is difficult. The exploit is now public and may be used. The patch is named e182471f8c5a22434346bd98da34d3b66c8c8b3e. It is recommended to apply a patch to fix this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-28T11:15:10.481Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-374488 | 78 xiaozhi-esp32 MQTT Goodbye mqtt_protocol.cc GetInstance denial of service",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/374488"
},
{
"name": "VDB-374488 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/374488/cti"
},
{
"name": "CVE-2026-13491 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-13491"
},
{
"name": "Submit #838439 | 78 xiaozhi-esp32 2aeecd4e014780ac15cfa4866906cca16267010d Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/838439"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/78/xiaozhi-esp32/issues/2022"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/78/xiaozhi-esp32/pull/2023"
},
{
"tags": [
"patch"
],
"url": "https://github.com/78/xiaozhi-esp32/commit/e182471f8c5a22434346bd98da34d3b66c8c8b3e"
},
{
"tags": [
"product"
],
"url": "https://github.com/78/xiaozhi-esp32/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-06-27T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-27T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-27T18:09:19.000Z",
"value": "VulDB entry last update"
}
],
"title": "78 xiaozhi-esp32 MQTT Goodbye mqtt_protocol.cc GetInstance denial of service"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-13491",
"datePublished": "2026-06-28T11:15:10.481Z",
"dateReserved": "2026-06-27T16:04:15.073Z",
"dateUpdated": "2026-06-28T11:15:10.481Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13489 (GCVE-0-2026-13489)
Vulnerability from nvd – Published: 2026-06-28 10:45 – Updated: 2026-06-28 10:45
VLAI
Title
78 xiaozhi-esp32 MCP Response mcp_server.cc ParseMessage improper synchronization
Summary
A weakness has been identified in 78 xiaozhi-esp32 up to 2.2.6. Affected by this issue is the function ParseMessage of the file main/mcp_server.cc of the component MCP Response Handler. This manipulation causes improper synchronization. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.
Severity
CWE
- CWE-662 - Improper Synchronization
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/374486 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/374486/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-13489 | third-party-advisory |
| https://vuldb.com/submit/838198 | third-party-advisory |
| https://github.com/78/xiaozhi-esp32/issues/2020 | exploitissue-tracking |
| https://github.com/78/xiaozhi-esp32/pull/2021 | issue-trackingpatch |
| https://github.com/78/xiaozhi-esp32/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| 78 | xiaozhi-esp32 |
Affected:
2.2.0
Affected: 2.2.1 Affected: 2.2.2 Affected: 2.2.3 Affected: 2.2.4 Affected: 2.2.5 Affected: 2.2.6 cpe:2.3:a:78:xiaozhi-esp32:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:78:xiaozhi-esp32:*:*:*:*:*:*:*:*"
],
"modules": [
"MCP Response Handler"
],
"product": "xiaozhi-esp32",
"vendor": "78",
"versions": [
{
"status": "affected",
"version": "2.2.0"
},
{
"status": "affected",
"version": "2.2.1"
},
{
"status": "affected",
"version": "2.2.2"
},
{
"status": "affected",
"version": "2.2.3"
},
{
"status": "affected",
"version": "2.2.4"
},
{
"status": "affected",
"version": "2.2.5"
},
{
"status": "affected",
"version": "2.2.6"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "dem0000 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in 78 xiaozhi-esp32 up to 2.2.6. Affected by this issue is the function ParseMessage of the file main/mcp_server.cc of the component MCP Response Handler. This manipulation causes improper synchronization. Remote exploitation of the attack is possible. The attack\u0027s complexity is rated as high. The exploitation is known to be difficult. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.1,
"vectorString": "AV:N/AC:H/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-662",
"description": "Improper Synchronization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-28T10:45:08.559Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-374486 | 78 xiaozhi-esp32 MCP Response mcp_server.cc ParseMessage improper synchronization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/374486"
},
{
"name": "VDB-374486 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/374486/cti"
},
{
"name": "CVE-2026-13489 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-13489"
},
{
"name": "Submit #838198 | 78 xiaozhi-esp32 36200942cca3f7cbac6c927ce7458bad874297ab Information Exposure / Improper Routing",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/838198"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/78/xiaozhi-esp32/issues/2020"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/78/xiaozhi-esp32/pull/2021"
},
{
"tags": [
"product"
],
"url": "https://github.com/78/xiaozhi-esp32/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-27T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-27T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-27T17:55:29.000Z",
"value": "VulDB entry last update"
}
],
"title": "78 xiaozhi-esp32 MCP Response mcp_server.cc ParseMessage improper synchronization"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-13489",
"datePublished": "2026-06-28T10:45:08.559Z",
"dateReserved": "2026-06-27T15:50:21.113Z",
"dateUpdated": "2026-06-28T10:45:08.559Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13491 (GCVE-0-2026-13491)
Vulnerability from cvelistv5 – Published: 2026-06-28 11:15 – Updated: 2026-06-28 11:15 X_Open Source
VLAI
Title
78 xiaozhi-esp32 MQTT Goodbye mqtt_protocol.cc GetInstance denial of service
Summary
A vulnerability was detected in 78 xiaozhi-esp32 up to 2.2.6. This vulnerability affects the function Application::GetInstance of the file main/protocols/mqtt_protocol.cc of the component MQTT Goodbye Handler. Performing a manipulation of the argument session_id results in denial of service. The attack is possible to be carried out remotely. The complexity of an attack is rather high. It is stated that the exploitability is difficult. The exploit is now public and may be used. The patch is named e182471f8c5a22434346bd98da34d3b66c8c8b3e. It is recommended to apply a patch to fix this issue.
Severity
CWE
- CWE-404 - Denial of Service
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/374488 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/374488/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-13491 | third-party-advisory |
| https://vuldb.com/submit/838439 | third-party-advisory |
| https://github.com/78/xiaozhi-esp32/issues/2022 | exploitissue-tracking |
| https://github.com/78/xiaozhi-esp32/pull/2023 | issue-trackingpatch |
| https://github.com/78/xiaozhi-esp32/commit/e18247… | patch |
| https://github.com/78/xiaozhi-esp32/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| 78 | xiaozhi-esp32 |
Affected:
2.2.0
Affected: 2.2.1 Affected: 2.2.2 Affected: 2.2.3 Affected: 2.2.4 Affected: 2.2.5 Affected: 2.2.6 cpe:2.3:a:78:xiaozhi-esp32:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:78:xiaozhi-esp32:*:*:*:*:*:*:*:*"
],
"modules": [
"MQTT Goodbye Handler"
],
"product": "xiaozhi-esp32",
"vendor": "78",
"versions": [
{
"status": "affected",
"version": "2.2.0"
},
{
"status": "affected",
"version": "2.2.1"
},
{
"status": "affected",
"version": "2.2.2"
},
{
"status": "affected",
"version": "2.2.3"
},
{
"status": "affected",
"version": "2.2.4"
},
{
"status": "affected",
"version": "2.2.5"
},
{
"status": "affected",
"version": "2.2.6"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "dem0000 (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in 78 xiaozhi-esp32 up to 2.2.6. This vulnerability affects the function Application::GetInstance of the file main/protocols/mqtt_protocol.cc of the component MQTT Goodbye Handler. Performing a manipulation of the argument session_id results in denial of service. The attack is possible to be carried out remotely. The complexity of an attack is rather high. It is stated that the exploitability is difficult. The exploit is now public and may be used. The patch is named e182471f8c5a22434346bd98da34d3b66c8c8b3e. It is recommended to apply a patch to fix this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.6,
"vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-28T11:15:10.481Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-374488 | 78 xiaozhi-esp32 MQTT Goodbye mqtt_protocol.cc GetInstance denial of service",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/374488"
},
{
"name": "VDB-374488 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/374488/cti"
},
{
"name": "CVE-2026-13491 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-13491"
},
{
"name": "Submit #838439 | 78 xiaozhi-esp32 2aeecd4e014780ac15cfa4866906cca16267010d Denial of Service",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/838439"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/78/xiaozhi-esp32/issues/2022"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/78/xiaozhi-esp32/pull/2023"
},
{
"tags": [
"patch"
],
"url": "https://github.com/78/xiaozhi-esp32/commit/e182471f8c5a22434346bd98da34d3b66c8c8b3e"
},
{
"tags": [
"product"
],
"url": "https://github.com/78/xiaozhi-esp32/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-06-27T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-27T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-27T18:09:19.000Z",
"value": "VulDB entry last update"
}
],
"title": "78 xiaozhi-esp32 MQTT Goodbye mqtt_protocol.cc GetInstance denial of service"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-13491",
"datePublished": "2026-06-28T11:15:10.481Z",
"dateReserved": "2026-06-27T16:04:15.073Z",
"dateUpdated": "2026-06-28T11:15:10.481Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13489 (GCVE-0-2026-13489)
Vulnerability from cvelistv5 – Published: 2026-06-28 10:45 – Updated: 2026-06-28 10:45
VLAI
Title
78 xiaozhi-esp32 MCP Response mcp_server.cc ParseMessage improper synchronization
Summary
A weakness has been identified in 78 xiaozhi-esp32 up to 2.2.6. Affected by this issue is the function ParseMessage of the file main/mcp_server.cc of the component MCP Response Handler. This manipulation causes improper synchronization. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.
Severity
CWE
- CWE-662 - Improper Synchronization
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/374486 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/374486/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-13489 | third-party-advisory |
| https://vuldb.com/submit/838198 | third-party-advisory |
| https://github.com/78/xiaozhi-esp32/issues/2020 | exploitissue-tracking |
| https://github.com/78/xiaozhi-esp32/pull/2021 | issue-trackingpatch |
| https://github.com/78/xiaozhi-esp32/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| 78 | xiaozhi-esp32 |
Affected:
2.2.0
Affected: 2.2.1 Affected: 2.2.2 Affected: 2.2.3 Affected: 2.2.4 Affected: 2.2.5 Affected: 2.2.6 cpe:2.3:a:78:xiaozhi-esp32:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:78:xiaozhi-esp32:*:*:*:*:*:*:*:*"
],
"modules": [
"MCP Response Handler"
],
"product": "xiaozhi-esp32",
"vendor": "78",
"versions": [
{
"status": "affected",
"version": "2.2.0"
},
{
"status": "affected",
"version": "2.2.1"
},
{
"status": "affected",
"version": "2.2.2"
},
{
"status": "affected",
"version": "2.2.3"
},
{
"status": "affected",
"version": "2.2.4"
},
{
"status": "affected",
"version": "2.2.5"
},
{
"status": "affected",
"version": "2.2.6"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "dem0000 (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in 78 xiaozhi-esp32 up to 2.2.6. Affected by this issue is the function ParseMessage of the file main/mcp_server.cc of the component MCP Response Handler. This manipulation causes improper synchronization. Remote exploitation of the attack is possible. The attack\u0027s complexity is rated as high. The exploitation is known to be difficult. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.1,
"vectorString": "AV:N/AC:H/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-662",
"description": "Improper Synchronization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-28T10:45:08.559Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-374486 | 78 xiaozhi-esp32 MCP Response mcp_server.cc ParseMessage improper synchronization",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/374486"
},
{
"name": "VDB-374486 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/374486/cti"
},
{
"name": "CVE-2026-13489 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-13489"
},
{
"name": "Submit #838198 | 78 xiaozhi-esp32 36200942cca3f7cbac6c927ce7458bad874297ab Information Exposure / Improper Routing",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/838198"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/78/xiaozhi-esp32/issues/2020"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/78/xiaozhi-esp32/pull/2021"
},
{
"tags": [
"product"
],
"url": "https://github.com/78/xiaozhi-esp32/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-27T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-27T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-06-27T17:55:29.000Z",
"value": "VulDB entry last update"
}
],
"title": "78 xiaozhi-esp32 MCP Response mcp_server.cc ParseMessage improper synchronization"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-13489",
"datePublished": "2026-06-28T10:45:08.559Z",
"dateReserved": "2026-06-27T15:50:21.113Z",
"dateUpdated": "2026-06-28T10:45:08.559Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}