CVE-2019-11779

CVE-2019-11779 affects Eclipse Mosquitto versions 1.5.0–1.6.5 (inclusive). A crafted MQTT SUBSCRIBE packet with a topic containing about 65,400 or more '/' characters can trigger a stack overflow in the broker, causing a denial of service. Public references show that the root cause is handling of...

CVE-2021-34431

CVE-2021-34431 affects Eclipse Mosquitto 1.6–2.0.10. The issue is a memory leak in the broker triggered when an authenticated client that previously connected with MQTT v5 sends a crafted CONNECT message, leading to a potential denial of service. The connected documents confirm the vulnerability ...

CVE-2019-11778

CVE-2019-11778 affects Eclipse Mosquitto 1.6.0–1.6.4. When an MQTT v5 client connects, and the will delay interval is longer than the session expiry interval, a use-after-free error may occur, potentially causing a crash in some situations. The connected Red Hat/SUSE and OSV entries reiterate the...

CVE-2021-41039

CVE-2021-41039 affects Eclipse Mosquitto versions 1.6–2.0.11, where an MQTT v5 client sending a large number of user-property properties can cause excessive CPU usage, potentially leading to denial of service. Public sources confirm the vulnerability and note fixes in later package updates: Debia...