Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 33 articles for you...
202
security advisorycriticalbug fixopenSUSE Leap 16.0 Mosquitto Essential Security Flaws RHSA-2026-20260-2
An update that solves 2 vulnerabilities and has 3 bug fixes can now be installed.. openSUSE security update: security update for mosquitto ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20260-1 Rating: critical References: * bsc#1232635 * bsc#1232636 * bsc#1258671 Cross-References: * CVE-2024-10525 * CVE-2024-3935 Affected Products: openSUSE Leap 16.0 ------------------------------------------------------------- An update that solves 2 vulnerabilities and has 3 bug fixes can now be installed. Description: This update for mosquitto fixes the following issues: Changes in mosquitto: - update to 2.0.23 (boo#1258671) * Fix handling of disconnected sessions for `per_listener_settings true` * Check return values of openssl *_get_ex_data() and *_set_ex_data() to prevent possible crash. This could occur only in extremely unlikely situations * Check return value of openssl ASN1_string_[get0_]data() functions for NULL. This prevents a crash in case of incorrect certificate handling in openssl * Fix potential crash on startup if a malicious/corrupt persistence file from mosquitto 1.5 or earlier is loaded * Limit auto_id_prefix to 50 characters - Update to version 2.0.22 Broker * Bridge: Fix idle_timeout never occurring for lazy bridges. * Fix case where max_queued_messages = 0 was not treated as unlimited. * Fix --version exit code and output. * Fix crash on receiving a $CONTROL message over a bridge, if per_listener_settings is set true and the bridge is carrying out topic remapping. * Fix incorrect reference clock being selected on startup on Linux. Closes #3238. * Fix reporting of client disconnections being incorrectly attributed to "out of memory". * Fix compilation when using WITH_OLD_KEEPALIVE. * Fix problems with secure websockets. * Fix crash on exit when using WITH_EPOLL=no. * Fix clients being incorrectly expired when they have keepalive ==max_keepalive. Closes #3226, #3286. Dynamic security plugin * Fix mismatch memory free when saving config which caused memory tracking to be incorrect. Client library * Fix C++ symbols being removed when compiled with link time optimisation. * TLS error handling was incorrectly setting a protocol error for non-TLS errors. This would cause the mosquitto_loop_start() thread to exit if no broker was available on the first connection attempt. This has been fixed. Closes #3258. * Fix linker errors on some architectures using cmake. - Update to version 2.0.21 Broker * Fix clients sending a RESERVED packet not being quickly disconnected. * Fix bind_interface producing an error when used with an interface that has an IPv6 link-local address and no other IPv6 addresses. * Fix mismatched wrapped/unwrapped memory alloc/free in properties. * Fix allow_anonymous false not being applied in local only mode. * Add retain_expiry_interval option to fix expired retained message not being removed from memory if they are not subscribed to. * Produce an error if invalid combinations of cafile/capath/certfile/keyfile are used. * Backport keepalive checking from develop to fix problems in current implementation. Client library * Fix potential deadlock in mosquitto_sub if -W is used. Apps * mosquitto_ctrl dynsec now also allows -i to specify a clientid as well as -c. This matches the documentation which states -i. Tests * Fix 08-ssl-connect-cert-auth-expired and 08-ssl-connect-cert-auth-revoked tests when under load. - systemd service: Wait till the network got setup to avoid startup failure. Patch instructions: To install this openSUSE security update use the suse recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 16.0 zypper in -t patch openSUSE-Leap-16.0-packagehub-138=1 Package List: - openSUSE Leap 16.0: libmosquitto1-2.0.23-bp160.1.1 libmosquittopp1-2.0.23-bp160.1.1 mosquitto-2.0.23-bp160.1.1 mosquitto-clients-2.0.23-bp160.1.1 mosquitto-devel-2.0.23-bp160.1.1 References: * https://www.suse.com/security/cve/CVE-2024-10525.html * https://www.suse.com/security/cve/CVE-2024-3935.html . Update critical security issues in openSUSE Leap 16.0's Mosquitto to prevent crashes and improve functionality.. openSUSE Mosquitto Security Update, Critical Security Fix, OpenSUSE Bug Fix, Software Update. . Severity: Critical. LinuxSecurity.com Team
Feb 24, 2026
•Critical
OpenSUSE
203
security advisoryremote exploitmemory leakMageia 2025-0106: mosquitto Security Advisory Updates
The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function. . MGASA-2025-0106 - Updated mosquitto packages fix security vulnerability Publication date: 19 Mar 2025 URL: https://advisories.mageia.org/MGASA-2025-0106.html Type: security Affected Mageia releases: 9 CVE: CVE-2023-28366 The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function. References: - https://bugs.mageia.org/show_bug.cgi?id=34116 - https://www.cve.org/CVERecord?id=CVE-2023-28366 SRPMS: - 9/core/mosquitto-2.0.21-1.mga9 . Eclipse Mosquitto updated to fix critical remote memory leak vulnerabilities. Essential for Mageia 9 users. Act now!. broker, eclipse, mosquitto, through, memory, abused. . Severity: Important. LinuxSecurity.com Team
Mar 19, 2025
•Important
Mageia
89
security advisoryfedoraupdateFedora 42 FEDORA-2025-f1ea97edd8 critical: mosquitto CVE-2023-28366 update
Update to 2.0.21, further fixes for CVE-2023-28366. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-f1ea97edd8 2025-03-18 00:15:21.924540+00:00 -------------------------------------------------------------------------------- Name : mosquitto Product : Fedora 42 Version : 2.0.21 Release : 1.fc42 URL : https://mosquitto.org/ Summary : Open Source MQTT v5/v3.1.x Broker Description : Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version v5 and 3.1.x. MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power sensors or mobile devices such as phones, embedded computers or micro-controllers like the Arduino. -------------------------------------------------------------------------------- Update Information: Update to 2.0.21, further fixes for CVE-2023-28366 -------------------------------------------------------------------------------- ChangeLog: * Thu Mar 6 2025 Peter Robinson - 2.0.21-1 - Update to 2.0.21 * Thu Feb 13 2025 Fabian Affolter - 2.0.20-5 - Only add openssl-devel-engine for Fedora -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-f1ea97edd8' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list
Mar 18, 2025
•Critical
Fedora
197
security advisorymoderateDebianDebian 11: DLA-4059-1 moderate: mosquitto MQTT broker crash
The following vulnerabilities have been discovered in the package mosquitto, MQTT message broker. . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4059-1
Feb 20, 2025
Debian LTS
172
security advisoryUbuntudosUbuntu 23.04, 22.04 LTS, 20.04 LTS Security Advisory: Mosquitto DoS
Several security issues were fixed in Mosquitto.. ========================================================================== Ubuntu Security Notice USN-6492-1 November 21, 2023 mosquitto vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 23.04 - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS (Available with Ubuntu Pro) Summary: Several security issues were fixed in Mosquitto. Software Description: - mosquitto: MQTT version 3.1/3.1.1 compatible message broker Details: Kathrin Kleinhammer discovered that Mosquitto incorrectly handled certain inputs. If a user or an automated system were provided with a specially crafted input, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-34431) Zhanxiang Song discovered that Mosquitto incorrectly handled certain inputs. If a user or an automated system were provided with a specially crafted input, a remote attacker could possibly use this issue to cause an authorisation bypass. This issue only affected Ubuntu 22.04 LTS and Ubuntu 23.04. (CVE-2021-34434) Zhanxiang Song, Bin Yuan, DeQing Zou, and Hai Jin discovered that Mosquitto incorrectly handled certain inputs. If a user or an automated system were provided with a specially crafted input, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2021-41039) Zhengjie Du discovered that Mosquitto incorrectly handled certain inputs. If a user or an automated system were provided with a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. (CVE-2023-0809) It was discovered that Mosquitto incorrectly handled certain inputs. If a user or an automated system were provided with a specially crafted input, a remote attacker could possibly use thisissue to cause a denial of service. (CVE-2023-3592) Mischa Bachmann discovered that Mosquitto incorrectly handled certain inputs. If a user or an automated system were provided with a specially crafted input, a remote attacker could possibly use this issue to cause a denial of service. This issue was only fixed in Ubuntu 22.04 LTS and Ubuntu 23.04. (CVE-2023-28366) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 23.04: mosquitto 2.0.11-1.2ubuntu0.1 Ubuntu 22.04 LTS: mosquitto 2.0.11-1ubuntu1.1 Ubuntu 20.04 LTS (Available with Ubuntu Pro): mosquitto 1.6.9-1ubuntu0.1~esm1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-6492-1 CVE-2021-34431, CVE-2021-34434, CVE-2021-41039, CVE-2023-0809, CVE-2023-28366, CVE-2023-3592 Package Information: https://launchpad.net/ubuntu/+source/mosquitto/2.0.11-1.2ubuntu0.1 https://launchpad.net/ubuntu/+source/mosquitto/2.0.11-1ubuntu1.1 . Uncover significant Mosquitto flaws impacting various Ubuntu versions and find out how to fortify your setup immediately.. Mosquitto Security, Ubuntu Issues, Denial of Service. . Severity: Critical. LinuxSecurity.com Team
Nov 21, 2023
•Critical
Ubuntu
87
security advisoryDoSmemory leakDebian 11 DSA-5511-1 Moderate DoS: Mosquitto Security Fixes
Several security vulnerabilities have been discovered in mosquitto, a MQTT compatible message broker, which may be abused for a denial of service attack. CVE-2021-34434 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 - ------------------------------------------------------------------------- Debian Security Advisory DSA-5511-1
Oct 01, 2023
Debian
89
security advisoryFedoramemory leakFedora 37: FEDORA-2023-e7ed15ab9e Moderate: Mosquitto Memory Leak Fixes
2.0.17 Broker: * Fix `max_queued_messages 0` stopping clients from receiving messages * Fix `max_inflight_messages` not being set correctly. Apps: * Fix `mosquitto_passwd -U` backup file creation. 2.0.16 Security: * CVE-2023-28366: Fix memory leak in broker when clients send multiple QoS 2 messages with the same message ID, but then never respond to the PUBREC. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2023-e7ed15ab9e 2023-09-01 01:27:54.588682 -------------------------------------------------------------------------------- Name : mosquitto Product : Fedora 37 Version : 2.0.17 Release : 1.fc37 URL : https://mosquitto.org/ Summary : Open Source MQTT v5/v3.1.x Broker Description : Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power sensors or mobile devices such as phones, embedded computers or micro-controllers like the Arduino. -------------------------------------------------------------------------------- Update Information: 2.0.17 Broker: * Fix `max_queued_messages 0` stopping clients from receiving messages * Fix `max_inflight_messages` not being set correctly. Apps: * Fix `mosquitto_passwd -U` backup file creation. 2.0.16 Security: * CVE-2023-28366: Fix memory leak in broker when clients send multiple QoS 2 messages with the same message ID, but then never respond to the PUBREC commands. * CVE-2023-0809: Fix excessive memory being allocated based on malicious initial packets that are not CONNECT packets. * CVE-2023-3592: Fix memory leak when clients send v5 CONNECT packets with a will message that contains invalid property types. * Broker will now reject Will messages that attempt to publish to $CONTROL/. * Broker nowvalidates usernames provided in a TLS certificate or TLS-PSK identity are valid UTF-8. * Fix potential crash when loading invalid persistence file. * Library will no longer allow single level wildcard certificates, e.g. *.com Broker: * Fix $SYS messages being expired after 60 seconds and hence unchanged values disappearing. * Fix some retained topic memory not being cleared immediately after used. * Fix error handling related to the `bind_interface` option. * Fix std* files not being redirected when daemonising, when built with assertions removed. * Fix default settings incorrectly allowing TLS v1.1. * Use line buffered mode for stdout. Closes #2354. * Fix bridges with non-matching cleansession/local_cleansession being expired on start after restoring from persistence. * Fix connections being limited to 2048 on Windows. The limit is now 8192, where supported. * Broker will log warnings if sensitive files are world readable/writable, or if the owner/group is not the same as the user/group the broker is running as. In future versions the broker will refuse to open these files. * mosquitto_memcmp_const is now more constant time. * Only register with DLT if DLT logging is enabled. * Fix any possible case where a json string might be incorrectly loaded. This could have caused a crash if a textname or textdescription field of a role was not a string, when loading the dynsec config from file only. * Dynsec plugin will not allow duplicate clients/groups/roles when loading config from file, which matches the behaviour for when creating them. * Fix heap overflow when reading corrupt config with "log_dest file". Client library: * Use CLOCK_BOOTTIME when available, to keep track of time. This solves the problem of the client OS sleeping and the client hence not being able to calculate the actual time for keepalive purposes. * Fix default settings incorrectly allowing TLS v1.1. * Fix high CPU use on slow TLS connect. Clients: * Fix incorrect topic-alias property value in mosquitto_sub jsonoutput. * Fix confusing message on TLS certificate verification. Apps: * mosquitto_passwd uses mkstemp() for backup files. * `mosquitto_ctrl dynsec init` will refuse to overwrite an existing file, without a race-condition. -------------------------------------------------------------------------------- ChangeLog: * Wed Aug 23 2023 Peter Robinson - 2.0.17-1 - Update to 2.0.17 * Fri Aug 18 2023 Peter Robinson - 2.0.16-1 - Update to 2.0.16 * Thu Jul 20 2023 Fedora Release Engineering - 2.0.15-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild * Thu Jan 19 2023 Fedora Release Engineering - 2.0.15-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-e7ed15ab9e' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Sep 01, 2023
•Important
Fedora
197
security advisorycritical issuesecurity updateDebian 9: DLA-2793-1 Critical: Mosquitto Null Dereference Issue
One security issue has been discovered in mosquitto: MQTT message broker. A null dereference vulnerability was found which could lead to crashes for applications using the library. . - ------------------------------------------------------------------------- Debian LTS Advisory DLA-2793-1
Oct 27, 2021
•Critical
Debian LTS
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!