Most recent entries from all

BELL-CVE-2024-8376

Affected: Alpaquita:23: mosquitto, Alpaquita:stream: mosquitto

EUVD-2026-198688

fkie_cve-2024-8376

In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending specific sequences of "CONNECT", "DISCONNECT", "SUBSCRIBE", "UNSUBSCRIBE" and "PUBLISH" packets.

GHSA-72qw-2vp3-gvg9

OESA-2024-2415 — mosquitto security update

Affected: openEuler:22.03-LTS-SP3: mosquitto

Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power sensors or mobile devices such as phones, embedded computers or micro-controllers like the Arduino. Security Fix(es): In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending specific sequences of "CONNECT", "DISCONNECT", "SUBSCRIBE", "UNSUBSCRIBE" and "PUBLISH" packets.(CVE-2024-8376)

RHSA-2024:8718 — Red Hat Security Advisory: Satellite 6.14.4.3 Async Update

mosquitto: sending specific sequences of packets may trigger memory leak foreman: Read-only access to entire DB from templates

SCA-2025-0006 — Vulnerability affecting picoScan and multiScan

The multiScan and picoScan are vulnerable to a denial-of-service (DoS) attack. A remote attacker can exploit this vulnerability by conducting a Slowloris-type attack, causing the web page to become unresponsive. Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader.h` when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer underflow vulnerability (when the file is parsed), leading to elevation of privilege. Tencent RapidJSON is vulnerable to privilege escalation due to an integer overflow in the GenericReader::ParseNumber() function of include/rapidjson/reader.h when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer overflow vulnerability (when the file is parsed), leading to elevation of privilege. SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE. A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0 via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the relevance of this report because a sqlite3.exe user already has full privileges (e.g., is intentionally all…

UBUNTU-CVE-2024-8376

Affected: Ubuntu:Pro:14.04:LTS: mosquitto, Ubuntu:Pro:16.04:LTS: mosquitto, Ubuntu:Pro:18.04:LTS: mosquitto, Ubuntu:Pro:20.04:LTS: mosquitto, Ubuntu:22.04:LTS: mosquitto, Ubuntu:Pro:24.04:LTS: mosquitto

VDE-2025-033 — ads-tec Industrial IT: Mosquitto MQTT Client Vulnerability in ADS-TEC IRF Products

The ADS-TEC firewall products IRF1000, IRF2000, and IRF3000 include Eclipse Mosquitto, affected by multiple vulnerabilities. Exploitation requires a compromised upstream MQTT broker, limiting direct device exposure.

WID-SEC-W-2024-3323 — Red Hat Satellite: Mehrere Schwachstellen

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Red Hat Satellite ausnutzen, um Informationen offenzulegen und weitere, nicht spezifizierte Auswirkungen zu verursachen.