Threats Tagged 'ghsa-g3vx-j9rx-jfm5'

Eclipse Vert.x MQTT client versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0 have a vulnerability where inbound QoS 2 PUBLISH messages are stored indefinitely in an internal map without size limits. A malicious MQTT broker can exploit this by sending many distinct QoS 2 PUBLISH messages and withholding PUBREL packets, causing unbounded memory growth and potential application degradation or out-of-memory crashes.