PT-2025-48653 · Eclipse · Eclipse Paho Go Mqtt V3.1

Paul Gerste · Published 2025-12-02 · Updated 2026-01-06 · CVE-2025-10543

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions 1.5.0 and earlier

Description The Eclipse Paho Go MQTT v3.1 library is susceptible to an issue where UTF-8 encoded strings exceeding 65535 bytes in length may be incorrectly encoded. This occurs because the data length is converted to an int16 without overflow checks, potentially leading to corrupt packets or data leakage—for example, a portion of an MQTT topic might be included in the message body of a PUBLISH packet. The issue arises from converting the data length from an int64 or int32 to an int16 without proper validation.

Recommendations Versions prior to 1.5.0 should be updated.

Fix

Weakness Enumeration

CWE-197

CWE-681

Related Identifiers

AZL-71299

AZL-71311

AZL-71320

AZL-71332

CVE-2025-10543

ECHO-D9CC-884F-AE57

GHSA-32FW-GQ77-F2F2

GO-2025-4173

SUSE-SU-2026:0037-1

Affected Products

Eclipse Paho Go Mqtt V3.1

References · 95

• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/254 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-71332 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-71320 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0037-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10543 · Security Note
• https://osv.dev/vulnerability/GHSA-32fw-gq77-f2f2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-10543 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-71311 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-71299 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4173 · Vendor Advisory
• https://github.com/eclipse-paho/paho.mqtt.golang/pull/714 · Note
• https://github.com/eclipse-paho/paho.mqtt.golang · Note
• https://github.com/eclipse-paho/paho.mqtt.golang/issues/730 · Note
• https://github.com/alpinelinux/build-server-status/commit/e3487897db32c8c3d0287643f8384a6669e93731 · Note
• https://suse.com/security/cve/CVE-2025-68941 · Note