MQTT Buffer Overflow Vulnerability

MQTT (Message Queuing Telemetry Transport) is a messaging protocol based on the Publish/Subscribe paradigm under the ISO standard (ISO/IEC PRF 20922), which works on the TCP/IP protocol family and is designed as a publish/subscribe messaging protocol for remote devices with low hardware performance and poor network conditions. A buffer overflow vulnerability exists in versions prior to Eclipse Paho MQTT C Client 1.1, which stems from the fact that the client does not check the size of the rem_len in the readpacket. No detailed vulnerability details are currently available.