Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Mosquitto
(Eclipse)| Repositories | https://github.com/eclipse/mosquitto |
| #Vulnerabilities | 26 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2023-09-01 | CVE-2023-28366 | The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function. | Mosquitto | 7.5 | ||
| 2023-10-18 | CVE-2023-5632 | In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of service type attack. This issue is fixed in 2.0.6 | Mosquitto | 7.5 |