Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Mageia 2025-0106: mosquitto Security Advisory Updates

mageia
Calendar Grey March 19, 2025
Dist Mageia Esm H88
Eclipse Mosquitto updated to fix critical remote memory leak vulnerabilities. Essential for Mageia 9 users. Act now!
The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, an...

Summary

The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function.

References

- https://bugs.mageia.org/show_bug.cgi?id=34116

- https://www.cve.org/CVERecord?id=CVE-2023-28366

Topics%20covered

Topics Covered

security advisory remote exploit memory leak Mageia mosquitto

Resolution

SRPMS

- 9/core/mosquitto-2.0.21-1.mga9

Severity
important
Lowest
Low
Medium
High
Critical

Publication date: 19 Mar 2025
URL: https://advisories.mageia.org/MGASA-2025-0106.html
Type: security
CVE: CVE-2023-28366

Topics%20covered

Topics Covered

security advisory remote exploit memory leak Mageia mosquitto

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here