Improper Handling of Exceptional Conditions and Origin Validation Error in Eclipse Paho Java client library

HIGH 7.5CVE-2019-11777 · GHSA-63qc-p2x4-9fgf · Published 11/09/2019 · updated 17/06/2026

In short

CVE-2019-11777 is a HIGH (CVSS 7.5) vulnerability affecting org.eclipse.paho:org.eclipse.paho.client.mqttv3, paho java client (eclipse).
Chance of exploitation in the next 30 days (EPSS): 0.83%, higher than 57.7% of all vulnerabilities.
Fix: update to 1.2.1 or later.

Package	Affected versions	Patched versions
org.eclipse.paho:org.eclipse.paho.client.mqttv3 Maven	`< 1.2.1`	`1.2.1`
paho java client eclipse	`= 1.2.0`	No fix yet

Description

In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the result of that verification is not checked. This could allow one MQTT server to impersonate another and provide the client library with incorrect information.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2019-11777 · ADVISORY
bugs.eclipse.org/bugs/show_bug.cgi · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free