| Package | Affected versions | Patched versions |
|---|---|---|
| mosquitto | ≥ 1.3.2, < 2.0.16 | 2.0.16 |
The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free