CVE-2023-28366

The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages...

Original description

The description as published by the source.

The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Fix status by distribution

Fixed packages published by each distribution for this CVE

Alpine Linux ALPINE-CVE-2023-28366 mosquitto Fixed in: 2.0.16-r0
Debian DEBIAN-CVE-2023-28366 mosquitto Fixed in: 2.0.11-1+deb11u1

References

advisory github.com
advisory lists.fedoraproject.org
advisory nvd.nist.gov
advisory security.gentoo.org
advisory debian.org
patch github.com
web github.com
web compass-security.com
web mosquitto.org