Description
In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on_subscribe callback. This affects the mosquitto_sub and mosquitto_rr clients.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Eclipse Foundation | mosquitto | 1.3.2 – ≤ 2.0.18 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | mosquitto | 2.0.20-1 | — |
| Debian 13 | mosquitto | 2.0.20-1 | — |
| Debian 12 | mosquitto | 2.0.11-1.2+deb12u2 | — |
| Debian 11 | mosquitto | 2.0.11-1+deb11u2 | DLA-4059-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | mosquitto | 2.0.11-1ubuntu1.2 | USN-7441-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | mosquitto | 2.0.18-1ubuntu0.1~esm1 | USN-7441-1 |
| Ubuntu Pro 20.04 LTS | mosquitto | 1.6.9-1ubuntu0.1~esm2 | USN-7441-1 |
| Ubuntu Pro 18.04 LTS | mosquitto | 1.4.15-2ubuntu0.18.04.3+esm2 | USN-7441-1 |
| Ubuntu Pro 16.04 LTS | mosquitto | 1.4.8-1ubuntu0.16.04.7+esm2 | USN-7441-1 |
| Ubuntu Pro 14.04 LTS | mosquitto | 0.15-2+deb7u3ubuntu0.1+esm1 | USN-7441-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | mosquitto | 2.0.23-bp160.1.1 | openSUSE-SU-2026:20260-1 |
Advisories 5
- USN-7441-1 mosquitto vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- openSUSE-SU-2026:20260-1 Security update for mosquitto SUSE / openSUSE Security Updates · Mar 23, 2026
- DLA-4059-1 mosquitto - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SCA-2025-0006 Vulnerability affecting picoScan and multiScan SICK PSIRT · Apr 28, 2025
- VDE-2025-033 ads-tec Industrial IT: Mosquitto MQTT Client Vulnerability in ADS-TEC IRF Products CERT@VDE · Apr 14, 2025