Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Mosquitto
(Eclipse)| Repositories | https://github.com/eclipse/mosquitto |
| #Vulnerabilities | 24 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2024-10-11 | CVE-2024-8376 | In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending specific sequences of "CONNECT", "DISCONNECT", "SUBSCRIBE", "UNSUBSCRIBE" and "PUBLISH" packets. | Mosquitto | 7.5 | ||
| 2023-09-01 | CVE-2023-28366 | The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function. | Mosquitto | 7.5 | ||
| 2023-10-02 | CVE-2023-0809 | In Mosquitto before 2.0.16, excessive memory is allocated based on malicious initial packets that are not CONNECT packets. | Mosquitto | 5.3 | ||
| 2023-10-02 | CVE-2023-3592 | In Mosquitto before 2.0.16, a memory leak occurs when clients send v5 CONNECT packets with a will message that contains invalid property types. | Mosquitto | 7.5 |