CVE-2019-11779

Name of the Vulnerable Software and Affected Versions Eclipse Mosquitto versions 1.5.0 through 1.6.5

Description The issue is related to insufficient exception state checking, which can be exploited by a remote attacker to cause a denial of service. This can happen when a malicious MQTT client sends a SUBSCRIBE packet containing a topic with approximately 65400 or more '/' characters, leading to a stack overflow.

Recommendations For Eclipse Mosquitto versions 1.5.0 through 1.6.5, consider restricting the length of topics in SUBSCRIBE packets to prevent stack overflows until a patch is available. As a temporary workaround, restrict access to the SUBSCRIBE functionality to minimize the risk of exploitation.