The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that…
Priority MEDIUM 41CWE-401Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-401.
Summary
The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0131 70th percentileScored 2026-11-07
Fix Fixed Red Hat: 2 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:mosquitto:*:*:*:*:*:*:*:* | 1.3.2 to before 2.0.16 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:mosquitto:*:*:*:*:*:*:*:* Versions 1.3.2 to before 2.0.16 Vulnerable ·Eclipse Foundation
Remediation
Red Hat 2 advisories
- RHSA-2024:1061 Released 2024-02-29 · Red Hat rating ModerateRed Hat Satellite 6 security and bug fix update
- Red Hat Satellite 6.13 for RHEL 8 foreman-3.5.1.24-1.el8sat, foreman-cli-3.5.1.24-1.el8sat, foreman-debug-3.5.1.24-1.el8sat +11
- RHSA-2024:0797 Released 2024-02-13 · Red Hat rating ImportantSatellite 6.14.2 Async Security Update
- Red Hat Satellite 6.14 for RHEL 8 candlepin-4.3.11-1.el8sat, candlepin-selinux-4.3.11-1.el8sat, mosquitto-2.0.17-1.el8sat +5
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Satellite 6.13 for RHEL 8 | Fixed | RHSA-2024:1061 |
| Red Hat Satellite 6.14 for RHEL 8 | Fixed | RHSA-2024:0797 |
Not affected: 4 products
- Red Hat Integration Camel K 1
- Red Hat Satellite 6.13 for RHEL 8
- Red Hat Satellite 6.14 for RHEL 8
- Red Hat build of Apache Camel for Spring Boot 3
Timeline
- 2026-10-02 Threatist record created from CVE-2023-28366
- 2026-10-03 Alias added: GHSA-897v-899r-j3hg
References
Advisory 4
More Eclipse Foundation Mosquitto vulnerabilities
- TI-2024-09749 Eclipse Mosquito: Heap Buffer Overflow in my_subscribe_callback CVSS 4.0HIGH 7.2
- TI-2018-09002 Reachable assertion in Eclipse Mosquitto CVSS 3.0HIGH 7.5
- TI-2017-05287 Uncontrolled resource consumption in Eclipse Mosquitto CVSS 3.0HIGH 7.5
- TI-2023-05183 Unconditionally adding an event to the epoll causes excessive CPU consumption CVSS 3.1HIGH 7.5
- TI-2018-09010 Improper authentication in Eclipse Mosquitto CVSS 3.0HIGH 8.1
- TI-2018-09009 When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file… CVSS 3.0HIGH 8.1
Sources
- CVE-2023-28366 · CVE Program
- CVE-2023-28366 · NVD
- FIRST EPSS
- GHSA-897v-899r-j3hg · GitHub Advisory Database · CC BY 4.0
- CVE-2023-28366 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences