Eclipse Paho Go MQTT may incorrectly encode strings if length exceeds 65535 bytes

🗓️ 02 Dec 2025 09:30:26Reported by GitHub Advisory DatabaseType

Paho Go MQTT before 1.5.0 may misencode strings over 65535 bytes, risking corrupt packets or leakage.

Reporter	Title	Published	Views	Family All 59
IBM Security Bulletins	Security Bulletin: Integer Overflow Leading to Packet Corruption in Eclipse Paho Go MQTT, affects watsonx.data	7 Apr 202611:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses os/exec 1.24.3; 1.24.4, ansible-9.4.0, github.com/eclipse/paho.mqtt.golang v1.3.5 and archive/tar 1.24.2; 1.24.4 which is vulnerable to CVE-2025-47906,CVE-2025-14010,CVE-2025-10543 and CVE-2025-58183	10 Mar 202608:18	–	ibm
CBLMariner	CVE-2025-10543 affecting package influxdb for versions less than 2.6.1-27	7 Jan 202619:09	–	cbl_mariner
CBLMariner	CVE-2025-10543 affecting package influxdb for versions less than 2.7.5-10	12 Jan 202621:27	–	cbl_mariner
CBLMariner	CVE-2025-10543 affecting package telegraf for versions less than 1.29.4-18	7 Jan 202619:09	–	cbl_mariner
CBLMariner	CVE-2025-10543 affecting package telegraf for versions less than 1.31.0-12	12 Jan 202621:27	–	cbl_mariner
Chainguard	CVE-2025-10543 vulnerabilities	3 Dec 202513:27	–	cgr
CNNVD	Eclipse Paho Go MQTT v3.1 library 安全漏洞	2 Dec 202500:00	–	cnnvd
CVE	CVE-2025-10543	2 Dec 202508:18	–	cve
Cvelist	CVE-2025-10543	2 Dec 202508:18	–	cvelist

Vulners

Node

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-10543
gitlab	www.gitlab.eclipse.org/security/vulnerability-reports/-/issues/254
github	www.github.com/eclipse-paho/paho.mqtt.golang/issues/730
github	www.github.com/eclipse-paho/paho.mqtt.golang/pull/714
github	www.github.com/alpinelinux/build-server-status/commit/e3487897db32c8c3d0287643f8384a6669e93731
github	www.github.com/advisories/GHSA-32fw-gq77-f2f2

17 Dec 2025 00:43Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.15.3

CVSS 46.3

EPSS0.00042

SSVC