Skip to content
OpenAdvisories
High USN-6685-1 1 CVE

mqtt-client vulnerability

Published Mar 7, 2024 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that mqtt-client incorrectly handled memory while parsing
malformed MQTT frames. An attacker could possibly use this issue to cause a
crash, resulting in a denial of service, or possibly execute arbitrary code.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS mqtt-client 1.14-1+deb10u1build0.20.04.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS mqtt-client 1.10-1ubuntu0.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS mqtt-client 1.14-1ubuntu0.18.04.1~esm1

Vulnerabilities 1

  • High 7.5
    CVE-2019-0222 Public exploit EPSS 12%

    Improper Control of Generation of Code ('Code Injection') in org.apache.activemq:activemq-client

    In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.

    Apache Apache ActiveMQ activemq activemq Debian Ubuntu Maven

References

  • report
    https://ubuntu.com/security/CVE-2019-0222