CVE-2023-28366: High severity tibco messaging - eclipse mosquitto distribution - core vulnerability
The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-28366?
CVE-2023-28366 is a vulnerability in Eclipse Mosquitto version 1.3.2 through 2.x before 2.0.16 that allows remote abuse of a memory leak when a client sends many QoS 2 messages with duplicate message IDs.
How does CVE-2023-28366 occur?
CVE-2023-28366 occurs due to a mishandling of EAGAIN from the libc send function in the broker of Eclipse Mosquitto.
What is the severity of CVE-2023-28366?
The severity of CVE-2023-28366 is high, with a severity value of 7.5.
Which software versions are affected by CVE-2023-28366?
Eclipse Mosquitto versions 1.3.2 through 2.x before 2.0.16 are affected by CVE-2023-28366.
How can CVE-2023-28366 be fixed?
To fix CVE-2023-28366, update your Eclipse Mosquitto version to 2.0.16 or newer.