CVE-2017-7653
The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF...
The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A malicious client could cause other clients that do reject invalid UTF-8 strings to disconnect themselves from the broker by sending a topic string which is not valid UTF-8, and so cause a denial of service for the clients.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A malicious client could cause other clients that do reject invalid UTF-8 strings to disconnect themselves from the broker by sending a topic string which is not valid UTF-8, and so cause a denial of service for the clients.
- Record
CVE-2017-7653- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A malicious client could cause other clients that do reject invalid UTF-8 strings to disconnect themselves from the broker by sending a topic string which is not valid UTF-8, and so cause a denial of service for the clients.
- Record
CVE-2017-7653- Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2017-16658 No score
The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A malicious client could cause other clients that do reject invalid UTF-8 strings to disconnect themselves from the broker by sending a topic string which is not valid UTF-8, and so cause a denial of service for the clients.
- Record
EUVD-2017-16658- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9xf7-gm92-xr5m
The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF...
The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A malicious client could cause other clients that do reject invalid UTF-8 strings to disconnect themselves from the broker by sending a topic string which is not valid UTF-8, and so cause a denial of service for the clients.
- Record
GHSA-9xf7-gm92-xr5m- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A malicious client could cause other clients that do reject invalid UTF-8 strings to disconnect themselves from the broker by sending a topic string which is not valid UTF-8, and so cause a denial of service for the clients.
- Record
CVE-2017-7653- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-7653
The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A malicious client could cause other clients that do reject invalid UTF-8 strings to disconnect themselves from the broker by sending a topic string which is not valid UTF-8, and so cause a denial of service for the clients.
- Record
DEBIAN-CVE-2017-7653- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-7653
The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A malicious client could cause other clients that do reject invalid UTF-8 strings to disconnect themselves from the broker by sending a topic string which is not valid UTF-8, and so cause a denial of service for the clients.
- Record
UBUNTU-CVE-2017-7653- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUSN-4023-1 No score
mosquitto vulnerabilities
It was discovered that Mosquitto broker incorrectly handled certain specially crafted input and network packets. A remote attacker could use this to cause a denial of service.
- Record
USN-4023-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mosquittoDebian:12 |
before 1.5.4-1 | 1.5.4-1 |
mosquittoDebian:13 |
before 1.5.4-1 | 1.5.4-1 |
mosquittoDebian:14 |
before 1.5.4-1 | 1.5.4-1 |
mosquittoDebian:8 From an advisory covering 3 CVEs |
before 1.3.4-2+deb8u3, plus listed versions 1.3.4-21.3.4-2+deb8u11.3.4-2+deb8u2 |
1.3.4-2+deb8u3 |
mosquittoDebian:9 From an advisory covering 4 CVEs |
before 1.4.10-3+deb9u2, plus listed versions 1.4.10-31.4.10-3+deb9u1 |
1.4.10-3+deb9u2 |
mosquittoUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 0.15-2ubuntu10.15-2ubuntu1.10.15-2ubuntu1.20.15-2+deb7u3ubuntu0.10.15-2+deb7u3ubuntu0.1+esm1 |
None known |
mosquittoUbuntu:16.04:LTS |
before 1.4.8-1ubuntu0.16.04.7, plus listed versions 1.4.3-11.4.4-11.4.7-11.4.8-11.4.8-1build1 Show 6 moreShow less1.4.8-1ubuntu0.16.04.11.4.8-1ubuntu0.16.04.21.4.8-1ubuntu0.16.04.31.4.8-1ubuntu0.16.04.41.4.8-1ubuntu0.16.04.51.4.8-1ubuntu0.16.04.6 |
1.4.8-1ubuntu0.16.04.7 |
mosquittoUbuntu:18.04:LTS |
before 1.4.15-2ubuntu0.18.04.3, plus listed versions 1.4.12-11.4.14-11.4.14-21.4.14-2build11.4.15-11.4.15-21.4.15-2ubuntu0.18.04.11.4.15-2ubuntu0.18.04.2 |
1.4.15-2ubuntu0.18.04.3 |
mosquittoUbuntu:16.04:LTS From an advisory covering 2 CVEs |
before 1.4.8-1ubuntu0.16.04.7, plus listed versions 1.4.3-11.4.4-11.4.7-11.4.8-11.4.8-1build1 Show 6 moreShow less1.4.8-1ubuntu0.16.04.11.4.8-1ubuntu0.16.04.21.4.8-1ubuntu0.16.04.31.4.8-1ubuntu0.16.04.41.4.8-1ubuntu0.16.04.51.4.8-1ubuntu0.16.04.6 |
1.4.8-1ubuntu0.16.04.7 |
mosquittoUbuntu:18.04:LTS From an advisory covering 2 CVEs |
before 1.4.15-2ubuntu0.18.04.3, plus listed versions 1.4.12-11.4.14-11.4.14-21.4.14-2build11.4.15-11.4.15-21.4.15-2ubuntu0.18.04.11.4.15-2ubuntu0.18.04.2 |
1.4.15-2ubuntu0.18.04.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-7653 is a medium vulnerability (CVSS 5.3) in Eclipse Mosquitto, published June 5, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.44%, the 73rd percentile. Fixed in mosquitto 1.5.4-1.