CVE-2023-0809: Medium severity Eclipse Mosquitto vulnerability
In Mosquitto before 2.0.16, excessive memory is allocated based on malicious initial packets that are not CONNECT packets.
Other sources
The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-0809?
CVE-2023-0809 is a vulnerability in Mosquitto before 2.0.16 that allows for excessive memory allocation based on malicious initial packets.
How does CVE-2023-0809 affect Mosquitto?
CVE-2023-0809 affects Mosquitto versions before 2.0.16.
What is the severity of CVE-2023-0809?
CVE-2023-0809 has a severity score of 5.8, which is considered medium.
How can I fix CVE-2023-0809?
To fix CVE-2023-0809, update Mosquitto to version 2.0.16 or later.
Where can I find more information about CVE-2023-0809?
You can find more information about CVE-2023-0809 in the references provided: [https://mosquitto.org/blog/2023/08/version-2-0-16-released/](https://mosquitto.org/blog/2023/08/version-2-0-16-released/), [https://github.com/eclipse/mosquitto/commit/a3c680fbb00a0019573fb84c29332e845e6efcad](https://github.com/eclipse/mosquitto/commit/a3c680fbb00a0019573fb84c29332e845e6efcad), [https://security-tracker.debian.org/tracker/CVE-2023-0809](https://security-tracker.debian.org/tracker/CVE-2023-0809).