In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
In Eclipse Hono version 1.3.0 and 1.4.0 the AMQP protocol adapter does not verify the size of AMQP messages received from devices. In particular, a device may send messages that are bigger than the max-message-size that the protocol adapter has indicated during link establishment. While the AMQP 1.0 protocol explicitly disallows a peer to send such messages, a hand crafted AMQP 1.0 client could exploit this behavior in order to send a message of unlimited size to the adapter, eventually causing the adapter to fail with an out of memory exception.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse Hono | 1.3.0; 1.4.0 | — | No fix listed | CNA |
| — | org.eclipse.hono:hono-core (Maven) | before 1.4.3 | 1.4.3 | Patch available | GHSA-9f52-hpvw-v96w |
- Eclipse Hono VendorEclipse Foundation Affected 1.3.0; 1.4.0 Fixed in — No fix listed CNA
- org.eclipse.hono:hono-core (Maven) Vendor— Affected before 1.4.3 Fixed in 1.4.3 Patch available GHSA-9f52-hpvw-v96w
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:hono:1.3.0:*:*:*:*:*:*:* | 1.3.0 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:hono:1.4.0:*:*:*:*:*:*:* | 1.4.0 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:hono:1.3.0:*:*:*:*:*:*:* Versions 1.3.0 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:hono:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·Eclipse Foundation
Remediation
- Fix · GHSA-9f52-hpvw-v96w org.eclipse.hono:hono-core (Maven) Fixed in 1.4.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-27217
- 2026-10-03 Alias added: GHSA-9f52-hpvw-v96w
References
More Eclipse Foundation Hono vulnerabilities
- TI-2020-16546 Missing authorization in Eclipse Hono CVSS 3.1HIGH 8.8
Sources
- CVE-2020-27217 · CVE Program
- CVE-2020-27217 · NVD
- FIRST EPSS
- GHSA-9f52-hpvw-v96w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences