Skip to main content
VulnerabilityPublished

Mosquitto: Heap-use-after-free

Affects mosquittoSource GCVE Database

0
Severity
High

Rated High by Threat Radar's AI analysis

Patch
Available – fixed in 30ee4a2d3e4e303e97ff6cd0b5f1c9f1a7f037d7

Data as of 15 Nov 2026, 01:53 UTC

What to do

Upgrade mosquitto to 30ee4a2d3e4e303e97ff6cd0b5f1c9f1a7f037d7.

Affected software

ProductAffectedFixed in
OSS-Fuzzmosquittopkg:generic/mosquittoOther threatsAffected
  • >=b555eebdd6fc7f34e76f06912213a511e1b7d28f <30ee4a2d3e4e303e97ff6cd0b5f1c9f1a7f037d7
Fixed in
  • 30ee4a2d3e4e303e97ff6cd0b5f1c9f1a7f037d7

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A patch is available and has been applied in the specified fixed commit. Users should update to the fixed version to remediate this vulnerability.

Description

A heap-use-after-free vulnerability was identified in the Mosquitto MQTT broker during password file cleanup. The issue was discovered via OSS-Fuzz and involves a read operation on freed heap memory in the password_file__cleanup function. A fix for this vulnerability has been committed.

References

Community reviews

Loading reviews…