GHSA-32fw-gq77-f2f2: github.com/eclipse/paho.mqtt.golang fixed in 1.5.1

GHSA-32fw-gq77-f2f2 PUBLISHED CVSS 6.300000190734863 MEDIUM

Eclipse Paho Go MQTT may incorrectly encode strings if length exceeds 65535 bytes

Record from GitHub Advisory Database · Published December 2, 2025

github.com/eclipse/paho.mqtt.golang is fixed in 1.5.1 (Go Modules)

Eclipse Paho Go MQTT may incorrectly encode strings if length exceeds 65535 bytes

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
github.com/eclipse/paho.mqtt.golang	Go Modules	1.5.1
elastic-agent-fips-8.19	Chainguard	8.19.8-r1
zabbix-agent2-6.0	Chainguard	6.0.43-r2
beats-fips-8.17	Chainguard	8.17.10-r3
beats-fips-8.18	Chainguard	8.18.8-r3
bento	Wolfi	1.13.1-r0
beats-fips-9.0	Chainguard	9.0.8-r3
elastic-agent-fips-9.1	Chainguard	9.1.8-r1
telegraf-1.35	Wolfi	1.35.4-r6
elastic-agent-fips-9.0	Chainguard	9.0.8-r3
falcosidekick	Chainguard	2.32.0-r3
beats-fips-8.19	Chainguard	8.19.8-r2

36 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 4.0

6.300000190734863

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected products

Vendor	Product	Versions
chainguard	elastic-agent-fips-8.19	0
chainguard	zabbix-agent2-6.0	0
chainguard	beats-fips-8.17	0
chainguard	beats-fips-8.18	0
wolfi	bento	0
chainguard	beats-fips-9.0	0
chainguard	elastic-agent-fips-9.1	0
wolfi	telegraf-1.35	0
chainguard	elastic-agent-fips-9.0	0
chainguard	falcosidekick	0
chainguard	beats-fips-8.19	0
chainguard	beats-fips-9.1	0
chainguard	beats-8.18	0
chainguard	influxd-2.7	0
chainguard	beats-8.17	0
chainguard	beats-9.2	0
chainguard	beats-9.1	0
wolfi	telegraf-1.34	0
chainguard	bento	0
chainguard	elastic-agent-9.1	0

…and 28 more

Timeline

Dec 2, 2025 CVE Published
Apr 29, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-32fw-gq77-f2f2
vulnetix vdb fixes GHSA-32fw-gq77-f2f2

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-32fw-gq77-f2f2/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →