Origin validation error in Eclipse Paho
Priority LOW 34CWE-346Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 1 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-346.
Summary
In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the result of that verification is not checked. This could allow one MQTT server to impersonate another and provide the client library with incorrect information.
Why it matters now
EPSS 0.00834 57th percentileScored 2026-11-07
Fix Partial org.eclipse.paho:org.eclipse.paho.client.mqttv3 (Maven): 1.2.1Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse Paho | 1.2.0 | — | No fix listed | CNA |
| — | org.eclipse.paho:org.eclipse.paho.client.mqttv3 (Maven) | before 1.2.1 | 1.2.1 | Patch available | GHSA-63qc-p2x4-9fgf |
- Eclipse Paho VendorEclipse Foundation Affected 1.2.0 Fixed in — No fix listed CNA
- org.eclipse.paho:org.eclipse.paho.client.mqttv3 (Maven) Vendor— Affected before 1.2.1 Fixed in 1.2.1 Patch available GHSA-63qc-p2x4-9fgf
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:paho_java_client:1.2.0:*:*:*:*:*:*:* | 1.2.0 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:paho_java_client:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Vulnerable ·Eclipse Foundation
Remediation
- Fix · GHSA-63qc-p2x4-9fgf org.eclipse.paho:org.eclipse.paho.client.mqttv3 (Maven) Fixed in 1.2.1 Advisory →
Red Hat 1 advisory
- RHSA-2020:5568 Released 2020-12-16 · Red Hat rating ImportantRed Hat Fuse 7.8.0 release and security update
- Red Hat Fuse 7.8.0
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat Fuse 7.8.0 | Fixed | RHSA-2020:5568 |
Timeline
- 2026-10-02 Threatist record created from CVE-2019-11777
- 2026-10-03 Alias added: GHSA-63qc-p2x4-9fgf
References
Sources
- CVE-2019-11777 · CVE Program
- CVE-2019-11777 · NVD
- FIRST EPSS
- GHSA-63qc-p2x4-9fgf · GitHub Advisory Database · CC BY 4.0
- CVE-2019-11777 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences