CVE-2023-5632

Published: Oct 18, 2023Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of service type attack. This issue is fixed in 2.0.6

Affected (1)

Products: Eclipse: Mosquitto

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Eclipse Mosquitto	Version 2.0.5

Related CWEs

Excessive Iteration

The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

References (4)

https://github.com/eclipse/mosquitto/commit/18bad1ff32435e523d7507e9b2ce0010124a8f2d

Source: emo@eclipse.org

Patch

https://github.com/eclipse/mosquitto/pull/2053

Source: emo@eclipse.org

Issue Tracking

https://github.com/eclipse/mosquitto/commit/18bad1ff32435e523d7507e9b2ce0010124a8f2d

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/eclipse/mosquitto/pull/2053

Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking

Timeline

No history available yet.