CVE-2025-10543: eclipse foundation paho.mqtt.golang (go mqtt v3.1 library) Numeric Truncation Error

Vulnerability summary

CVE-2025-10543 is a medium (CVSS 6.3) Numeric Truncation Error vulnerability in eclipse foundation paho.mqtt.golang (go mqtt v3.1 library). EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 12.5% of scored vulnerabilities.

Timeline

1. 02-12-2025
   PublishedVulnerability first disclosed.
2. 02-12-2025
   Last modifiedVulnerability information updated.

Description

In Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0 UTF-8 encoded strings, passed into the library, may be incorrectly encoded if their length exceeds 65535 bytes. This may lead to unexpected content in packets sent to the server (for example, part of an MQTT topic may leak into the message body in a PUBLISH packet). The issue arises because the length of the data passed in was converted from an int64/int32 (depending upon CPU) to an int16 without checks for overflows. The int16 length was then written, followed by the data (e.g. topic). This meant that when the data (e.g. topic) was over 65535 bytes then the amount of data written exceeds what the length field indicates. This could lead to a corrupt packet, or mean that the excess data leaks into another field (e.g. topic leaks into message body).

• CWE-197Numeric Truncation ErrorTruncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.
• CWE-681Incorrect Conversion between Numeric TypesWhen converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.