PT-2023-5226 · Eclipse+3 · Eclipse Mosquitto+3

Mischa Bachmann · Published 2023-08-16 · Updated 2025-09-03 · CVE-2023-28366

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Eclipse Mosquitto versions 1.3.2 through 2.x before 2.0.16

Description The issue is related to a memory leak in the broker of Eclipse Mosquitto. This memory leak can be exploited remotely when a client sends many QoS 2 messages with duplicate message IDs and fails to respond to PUBREC commands. The cause of this issue is the mishandling of EAGAIN from the libc send function. This can lead to a denial of service.

Recommendations For Eclipse Mosquitto versions 1.3.2 through 2.x before 2.0.16, update to version 2.0.16 or later to resolve the memory leak issue. As a temporary workaround, consider restricting the handling of QoS 2 messages with duplicate message IDs to minimize the risk of exploitation. Additionally, ensure that clients properly respond to PUBREC commands to prevent abuse.

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

ALT-PU-2025-1041

ALT-PU-2025-3746

BDU:2023-05834

CVE-2023-28366

DSA-5511-1

MGASA-2025-0106

OESA-2023-1658

OESA-2023-1659

OESA-2023-1680

OPENSUSE-SU-2024:13546-1

RHSA-2024:0797

RHSA-2024:1061

ROSA-SA-2025-2633

USN-6492-1

Affected Products

Alt Linux

Eclipse Mosquitto

Linuxmint

Ubuntu

References · 44

• https://github.com/eclipse/mosquitto/commit/6113eac95a9df634fbc858be542c4a0456bfe7b9 · Patch
• https://ubuntu.com/security/CVE-2023-3592 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-28366 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1659 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-34431 · Vendor Advisory
• https://debian.org/security/2023/dsa-5511 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28366 · Security Note
• https://ubuntu.com/security/CVE-2023-28366 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2023-28366 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-0809 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-34434 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0106 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/KJ2FMBGVVQEQWTTQB7YLKTAHMX2UM66X · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28366 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1680 · Vendor Advisory