CVE-2018-12550

CVE-2018-12550 affects Eclipse Mosquitto 1.0–1.5.5 when an ACL file is configured but empty or only comments/blank lines, causing the broker to treat the file as defined and switch from a default deny to a default allow policy. Public disclosures in connected docs confirm the vulnerability behavi...

CVE-2018-12551

CVE-2018-12551 affects Eclipse Mosquitto 1.0–1.5.5 when a password file is used for authentication: malformed data in the file can be treated as a valid username (e.g., a blank line), allowing bypass of authentication. Other security measures remain unaffected, and users relying on mosquitto_pass...

CVE-2018-12546

The CVE describes a vulnerability in Eclipse Mosquitto where, for versions 1.0–1.5.5, a retained message published to a topic remains delivered to future subscribers after that client’s access to the topic is revoked, potentially enabling effects not allowed by normal access controls. This is a s...

CVE-2017-7652

CVE-2017-7652 affects Eclipse Mosquitto (notably around version 1.4.14) where reloading configuration on SIGHUP can exhaust file descriptors/sockets, preventing opening the config file. Publicly documented impact includes potential configuration reload failures due to FD exhaustion. Remediation g...

CVE-2017-7655

CVE-2017-7655 affects the Eclipse Mosquitto broker/library (versions 1.0–1.4.15). The root cause is a Null Dereference in the Mosquitto library, which could cause crashes for applications using the library and lead to a denial of service. Public advisories note remediation via upgrading Mosquitto...