Description
The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mosquitto | 2.0.17-1 | — |
| Debian 13 | mosquitto | 2.0.17-1 | — |
| Debian 12 | mosquitto | 2.0.11-1.2+deb12u1 | DSA-5511-1 |
| Debian 11 | mosquitto | 2.0.11-1+deb11u1 | DSA-5511-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | mosquitto | 2.0.11-1ubuntu1.1 | USN-6492-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | mosquitto | 1.6.9-1ubuntu0.1~esm1 | USN-6492-1 |
| Ubuntu Pro 18.04 LTS | mosquitto | No fix yet | — |
| Ubuntu Pro 16.04 LTS | mosquitto | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman +1 | 3.5.1.24-1.el8sat | RHSA-2024:1061 |
| Red Hat Satellite Capsule 6 | foreman +1 | 3.5.1.24-1.el8sat | RHSA-2024:1061 |
| Red Hat Satellite Capsule 6 | mosquitto | 2.0.17-1.el8sat | RHSA-2024:1061, RHSA-2024:0797 |
| Red Hat Satellite Capsule 6 | puppet-agent | 7.27.0-1.el8sat | RHSA-2024:0797 |
| Red Hat Satellite Capsule 6 | puppetserver | 7.14.0-1.el8sat | RHSA-2024:0797 |
| Red Hat Satellite 6 | candlepin +1 | 4.3.11-1.el8sat | RHSA-2024:0797 |
| Red Hat Satellite 6 | foreman +12 | 3.5.1.24-1.el8sat | RHSA-2024:1061 |
| Red Hat Satellite 6 | mosquitto | 2.0.17-1.el8sat | RHSA-2024:1061, RHSA-2024:0797 |
| Red Hat Satellite 6 | puppet-agent | 7.27.0-1.el8sat | RHSA-2024:0797 |
| Red Hat Satellite 6 | puppetserver | 7.14.0-1.el8sat | RHSA-2024:0797 |
| Red Hat Satellite 6 | rubygem-grpc | 1.58.0-1.el8sat | RHSA-2024:0797 |
| Red Hat Satellite 6 | rubygem-puma | 6.3.1-1.el8sat | RHSA-2024:0797 |
| Red Hat Satellite 6 | rubygem-sidekiq | 6.5.12-1.el8sat | RHSA-2024:0797 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | mosquitto | 2.0.16-r0 | — |
| Alpine v3.23 | mosquitto | 2.0.16-r0 | — |
| Alpine v3.22 | mosquitto | 2.0.16-r0 | — |
| Alpine v3.21 | mosquitto | 2.0.16-r0 | — |
| Alpine v3.20 | mosquitto | 2.0.16-r0 | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | mosquitto | 2.0.16-r0 | — |
| Alpine v3.18 | mosquitto | 2.0.16-r0 | — |
Advisories 6
- RHSA-2024:0797 Red Hat Security Advisory: Satellite 6.14.2 Async Security Update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:1061 Red Hat Security Advisory: Red Hat Satellite 6 security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-6492-1 mosquitto vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-5511-1 mosquitto - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SCA-2025-0006 Vulnerability affecting picoScan and multiScan SICK PSIRT · Apr 28, 2025
- WID-SEC-2023-2724 IBM Integration Bus: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Oct 22, 2023
References
- https://github.com/eclipse/mosquitto/compare/v2.0.15...v2.0.16
- https://www.compass-security.com/fileadmin/Research/Advisories/2023_02_CSNC-2023-001_Eclipse_Mosquitto_Memory_Leak.txt
- https://mosquitto.org/blog/2023/08/version-2-0-16-released/
- https://github.com/eclipse/mosquitto/commit/6113eac95a9df634fbc858be542c4a0456bfe7b9
- FEDORA-2023-9adc4be8b0 vendor-advisory
- DSA-5511 vendor-advisory
- GLSA-202401-09 vendor-advisory