CVE-2017-7651

2018-04-2414:00:00

CWE-789

eclipse

www.cve.org

AI Score

7.3

Confidence

High

EPSS

0.003

Percentile

68.9%

JSON

In Eclipse Mosquitto 1.4.14, a user can shutdown the Mosquitto server simply by filling the RAM memory with a lot of connections with large payload. This can be done without authentications if occur in connection phase of MQTT protocol.

CNA Affected

[
  {
    "product": "Eclipse Mosquitto",
    "vendor": "The Eclipse Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "1.4.14"
      }
    ]
  }
]