Mosquitto (Eclipse Foundation) - vulnerabilities (CVEs)

4 CVEs, 0 in the last 30 days, 3 known versions, newest CVE from 2024-10-30. Vendor: Eclipse Foundation.

CVEs of Mosquitto

• CVE-2024-3935 - CVSS 6.5 (medium), 2024-10-30: In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge…
• CVE-2024-10525 - CVSS 9.8 (critical), 2024-10-30: In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto…
• CVE-2024-8376 - CVSS 7.5 (high), 2024-10-11: In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending specific sequences of…
• CVE-2017-7650 - CVSS 6.5 (medium), 2017-09-11: In Mosquitto before 1.4.12, pattern based ACLs can be bypassed by clients that set their username/client id to '#' or '+'. This allows locally or remotely…