CVE-2023-28366
Published: 01 September 2023
Summary
CVE-2023-28366 is a high-severity Missing Release of Memory after Effective Lifetime (CWE-401) vulnerability in Eclipse Mosquitto. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 30.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-32063
Vulnerability details
The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs…
more
because of mishandling of EAGAIN from the libc send function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.