Threats tagged 'ghsa-cm54-mprw-5279'

Eclipse Mosquitto versions 1.3.2 through 2.0.18 contain a vulnerability where a malicious broker can send a crafted SUBACK packet lacking reason codes. This causes a client using libmosquitto to perform out-of-bounds memory access during its on_subscribe callback, affecting mosquitto_sub and mosquitto_rr clients. The vulnerability has a critical severity with a CVSS score of 9.1.