Eclipse Mosquitto vulnerabilities, page 2
26 vulnerabilities
Known vulnerabilities in Eclipse Mosquitto, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2019-11778debianmosquitto+2
EPSS score0.76%
If an MQTT v5 client connects to Eclipse Mosquitto versions 1.6.0 to 1.6.4 inclusive, sets a last will and testament, sets a will delay interval, sets a session expiry interval, and the will delay interval is set longer than the session expiry interval, then a use after free error occurs, which has the potential to cause a crash in some situations.CVE-2019-11779alpinemosquitto+11EPSS score2.74%
In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur.CVE-2023-0809alpinemosquitto+3EPSS score0.71%
In Mosquitto before 2.0.16, excessive memory is allocated based on malicious initial packets that are not CONNECT packets.CVE-2023-5632debianmosquitto+2EPSS score0.80%
In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of service type attack. This issue is fixed in 2.0.6CVE-2023-28366alpinemosquitto+4EPSS score1.31%
The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function.CVE-2023-3592alpinemosquitto+3EPSS score0.79%
In Mosquitto before 2.0.16, a memory leak occurs when clients send v5 CONNECT packets with a will message that contains invalid property types.