VDB

GCVE-110-MAGEIA-2025-106

GCVE-110-MAGEIA-2025-106
Advisory Published
Vulnetix · Advisory published March 19, 2025
The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function.
Download JSON Open in Console

Affected Products

VendorProductVersionsPlatforms
Mageiamosquitto0 (affected), 2.0.21-1.mga9 (unaffected), 0 (affected), 2.0.21-1.mga9 (unaffected)—
Mageianvidia-current0 (affected), 580.119.02-1.mga9.nonfree (unaffected)—
Mageialdetect-lst0.6.63-1.mga9 (unaffected), 0 (affected)—

Aliases

CVE-2023-28366

References

Updated mosquitto packages fix security vulnerability
advisory
Updated mosquitto packages fix security vulnerability
issue
Updated nvidia-current & ldetect-lst packages fix bug
advisory
Updated nvidia-current & ldetect-lst packages fix bug
issue
Updated nvidia-current & ldetect-lst packages fix bug
issue

Browse GCVE Records

74,147 records in the GCVE database · Updated July 21, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON
$ Console Community · 100/wk Open console ›