33 matches found
CVE-2026-73863
NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's broker-side MQTT v5 nmqsubinfodecode function in nng/src/sp/protocol/mqtt/mqttparser.c reuses lenofvarint from the outer Properties Length while parsing each SUBSCRIPTIONIDENTIFIER. A remote client can send a SUBSCRIBE packet with a multi-byte...
CVE-2026-73863: Out-of-bounds Read
NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's broker-side MQTT v5 nmqsubinfodecode function in nng/src/sp/protocol/mqtt/mqttparser.c reuses lenofvarint from the outer Properties Length while parsing each SUBSCRIPTIONIDENTIFIER. A remote client can send a SUBSCRIBE packet with a multi-byte...
EUVD-2019-0481
Malware in sbrugna...
EUVD-2019-3446
Malware in sbrugna...
CVE-2019-5432
A specifically malformed MQTT Subscribe packet crashes MQTT Brokers using the mqtt-packet module versions 3.5.1, 4.0.0 - 4.1.3, 5.0.0 - 5.6.1, 6.0.0 - 6.1.2 for decoding...
PT-2024-38981
Name of the Vulnerable Software and Affected Versions: Eclipse Mosquitto versions up to 2.0.18a Description: The issue allows an attacker to cause memory leaking, segmentation fault, or heap-use-after-free by sending specific sequences of packets, including "CONNECT", "DISCONNECT", "SUBSCRIBE",...
Eclipse Mosquitto DoS
The vulnerability of the Eclipse Mosquitto messaging broker is related to insufficient checking of exceptional states. Exploiting this vulnerability allows a malicious actor to cause a service failure by sending a SUBSCRIBE packet containing approximately 65,400 or more characters '/'...
Updated mosquitto packages fix security vulnerability
Updated mosquitto packages fix security vulnerability: A vulnerability was discovered in mosquitto, allowing a malicious MQTT client to cause a denial of service stack overflow and daemon crash, by sending a specially crafted SUBSCRIBE packet containing a topic with a extremely deep hierarchy...
Debian DSA-4570-1 : mosquitto - security update
A vulnerability was discovered in mosquitto, a MQTT version 3.1/3.1.1 compatible message broker, allowing a malicious MQTT client to cause a denial of service stack overflow and daemon crash, by sending a specially crafted SUBSCRIBE packet containing a topic with a extremely deep hierarchy. C...
Debian DLA-1972-1 : mosquitto security update
Several issues have been found in mosquitto, a MQTT version 3.1/3.1.1 compatible message broker. CVE-2017-7655 A Null dereference vulnerability in the Mosquitto library could lead to crashes for those applications using the library. CVE-2018-12550 An ACL file with no statements was treated as...
CVE-2019-11779
In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur...
Stack overflow
In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur...
CVE-2019-11779
In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur...
CVE-2019-11779
In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur...
CVE-2019-11779
In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur...
PT-2019-4894 · Eclipse +3 · Eclipse Mosquitto +3
Name of the Vulnerable Software and Affected Versions: Eclipse Mosquitto versions 1.5.0 through 1.6.5 Description: The issue is related to insufficient exception state checking, which can be exploited by a remote attacker to cause a denial of service. This can happen when a malicious MQTT client...
CVE-2019-11779: Improper Check for Unusual or Exceptional Conditions
In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur...
Improper Input Validation and Buffer Over-read in mqtt-packet
A specifically malformed MQTT Subscribe packet crashes MQTT Brokers using the mqtt-packet module versions 3.5.1, 4.0.0 - 4.1.3, 5.0.0 - 5.6.1, 6.0.0 - 6.1.2 for decoding...
