PT-2023-9154 · Eclipse+4 · Eclipse Mosquitto+4

Published 2023-10-01 · Updated 2025-03-10 · CVE-2023-0809

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Eclipse Mosquitto versions prior to 2.0.16

Description The issue is related to excessive memory allocation based on malicious initial packets that are not CONNECT packets. This can be exploited by a remote attacker to cause a denial of service.

Recommendations For versions prior to 2.0.16, update to version 2.0.16 or later to resolve the issue. As a temporary workaround, consider restricting access to the broker to minimize the risk of exploitation.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

CWE-789

Related Identifiers

ALT-PU-2025-1041

ALT-PU-2025-3746

BDU:2024-04210

CVE-2023-0809

DSA-5511-1

OESA-2023-1716

OESA-2023-1717

OESA-2023-1718

OPENSUSE-SU-2024:13546-1

RHSA-2024:0797

RHSA-2024:1061

ROSA-SA-2025-2633

USN-6492-1

Affected Products

Alt Linux

Eclipse Mosquitto

Linuxmint

Red Os

Ubuntu

References · 31

• https://ubuntu.com/security/CVE-2023-3592 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1718 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0809 · Security Note
• https://ubuntu.com/security/CVE-2021-34431 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1716 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6492-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-0809 · Security Note
• https://bdu.fstec.ru/vul/2024-04210 · Security Note
• https://ubuntu.com/security/CVE-2023-28366 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1717 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-0809 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-0809 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6492-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5511-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-0809 · Vendor Advisory