CVE-2016-10523

MQTT before 3.4.6 and 4.0.x before 4.0.5 allows specifically crafted MQTT packets to crash the application, making a DoS attack feasible with very little bandwidth.

Score

CVSS 3.0 7.5 High

Status

Modified - support@hackerone.com

Published

2018-05-31

Last modified

2024-09-17

Weaknesses

CWE-119, CWE-400

Affected products

• Mqtt-packet Node Module (Hackerone)
• Mqtt-packet (Mqtt-packet Project)

References

• https://github.com/mcollina/mosca/issues/393
• https://github.com/mqttjs/mqtt-packet/pull/8
• https://nodesecurity.io/advisories/75