{"id":"CVE-2019-11779","aliases":["ALPINE-CVE-2019-11779","BELL-CVE-2019-11779","DEBIAN-CVE-2019-11779","DLA-1972-1","DSA-4570-1","EUVD-2019-3446","GHSA-wjwr-9f4q-q8h8","MGASA-2019-0345","openSUSE-SU-2019:2206-1","openSUSE-SU-2019:2247-1","openSUSE-SU-2024:11057-1"],"status":"published","title":"In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE...","description":"In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02742,"percentile":0.86274,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-674","CWE-754"],"published":"2019-09-19T13:30:43Z","modified":"2026-10-24T10:30:37Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"mosquitto","fixed_in":["1.6.3-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"mosquitto","fixed_in":["1.6.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"mosquitto","fixed_in":["1.6.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"mosquitto","fixed_in":["1.6.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"mosquitto","fixed_in":["1.6.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"mosquitto","fixed_in":["1.6.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"mosquitto","fixed_in":["1.6.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"mosquitto","fixed_in":["1.6.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"mosquitto","fixed_in":["1.6.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"mosquitto","fixed_in":["1.6.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"mosquitto","fixed_in":["1.6.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"mosquitto","fixed_in":["1.6.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"mosquitto","fixed_in":["1.6.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"mosquitto","fixed_in":["1.6.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"mosquitto","fixed_in":["1.6.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"mosquitto","fixed_in":["1.5.6-r1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"mosquitto","fixed_in":["1.6.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mosquitto","fixed_in":["1.6.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mosquitto","fixed_in":["1.6.6-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"mosquitto","fixed_in":["1.5.7-1+deb10u1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"mosquitto","fixed_in":["1.6.6-1.mga7"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"mosquitto","fixed_in":["1.5.7-lp151.2.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP1","package":"mosquitto","fixed_in":["1.5.7-bp151.3.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5"},{"fixed":"1.6.3-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5"},{"fixed":"1.6.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5"},{"fixed":"1.6.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5"},{"fixed":"1.6.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5"},{"fixed":"1.6.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5"},{"fixed":"1.6.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5"},{"fixed":"1.6.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5"},{"fixed":"1.6.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5"},{"fixed":"1.6.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5"},{"fixed":"1.6.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5"},{"fixed":"1.6.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5"},{"fixed":"1.6.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5"},{"fixed":"1.6.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5"},{"fixed":"1.6.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5"},{"fixed":"1.6.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5"},{"fixed":"1.5.6-r1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4-2+deb8u4"}]}],"versions":["1.3.4-2","1.3.4-2+deb8u1","1.3.4-2+deb8u2","1.3.4-2+deb8u3"],"bundled":4},{"source":"osv","ecosystem":"Debian:10","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.7-1+deb10u1"}]}],"versions":["1.5.7-1"]},{"source":"osv","ecosystem":"Mageia:7","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.6-1.mga7"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.7-lp151.2.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.7-bp151.3.3.1"}]}]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"eclipse","product":"mosquitto"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"opensuse","product":"backports_sle"},{"vendor":"opensuse","product":"leap"},{"vendor":"the eclipse foundation","product":"eclipse mosquitto"}],"references":[{"url":"https://bugs.eclipse.org/bugs/show_bug.cgi?id=551160","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4137-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00077.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00008.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HFWQBNFTAVHPUYNGYO2TCPF5PCSWC2Z7/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWNVTFA2CKXERXRYPYE2YFTZP4GNBGYY/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4WMHIM64Q35NGTR6R3ILZUL4MA4ANB5/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/10/msg00035.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2019/dsa-4570","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://seclists.org/bugtraq/2019/Nov/25","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11779"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D4WMHIM64Q35NGTR6R3ILZUL4MA4ANB5/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HFWQBNFTAVHPUYNGYO2TCPF5PCSWC2Z7/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JWNVTFA2CKXERXRYPYE2YFTZP4GNBGYY/"},{"url":"https://github.com/advisories/GHSA-wjwr-9f4q-q8h8"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-11779","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-11779","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-11779","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0345.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25728","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/P6G5KTRFNUICAFNG2F4INONW2KV5YBAK/#P6G5KTRFNUICAFNG2F4INONW2KV5YBAK","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1151494","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11779","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HM4BH6TF6Y33PDPP5RQIILYN7TCGMPWW/#HM4BH6TF6Y33PDPP5RQIILYN7TCGMPWW","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12543","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12546","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28166","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-11779","description":"In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur.","status":"published","published":"2019-09-19T13:30:43Z","modified":"2024-08-04T23:03:32.805Z","cwes":["CWE-754"],"updated_at":"2026-11-02T14:20:26.416173Z"}],"euvd":[{"id":"EUVD-2019-3446","description":"In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur.","status":"published","published":"2019-09-19T13:30:43Z","modified":"2024-08-04T23:03:32Z","updated_at":"2026-11-03T02:40:47.960625Z"}],"ghsa":[{"id":"GHSA-wjwr-9f4q-q8h8","title":"In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE...","description":"In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur.","status":"published","published":"2022-05-24T16:56:28Z","modified":"2023-01-28T05:07:34Z","cwes":["CWE-674"],"updated_at":"2026-11-02T14:44:32.600172Z"}],"nvd":[{"id":"CVE-2019-11779","description":"In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur.","status":"published","published":"2019-09-19T14:15:10.573Z","modified":"2026-06-17T02:13:37.66Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-754","CWE-674"],"updated_at":"2026-11-02T14:05:28.126831Z"}],"osv":[{"id":"ALPINE-CVE-2019-11779","description":"In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur.","status":"published","published":"2019-09-19T14:15:10.573Z","modified":"2026-09-21T06:17:52.461229191Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"BELL-CVE-2019-11779","title":"CVE-2019-11779 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:41.3921Z","modified":"2026-01-26T09:49:30.290188Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2019-11779","description":"In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur.","status":"published","published":"2019-09-19T14:15:10.573Z","modified":"2026-10-24T10:30:37.097860531Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:10.718934Z"},{"id":"DEBIAN-CVE-2019-11779","description":"In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur.","status":"published","published":"2019-09-19T14:15:10.573Z","modified":"2026-09-21T07:01:29.814836769Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"DLA-1972-1","title":"mosquitto - security update","status":"published","published":"2019-10-26T00:00:00Z","modified":"2026-03-09T01:20:27.623062Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-4570-1","title":"mosquitto - security update","status":"published","published":"2019-11-17T00:00:00Z","modified":"2026-03-09T02:10:25.546499Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2019-0345","title":"Updated mosquitto packages fix security vulnerability","description":"Updated mosquitto packages fix security vulnerability:\n\nA vulnerability was discovered in mosquitto, allowing a malicious MQTT\nclient to cause a denial of service (stack overflow and daemon crash),\nby sending a specially crafted SUBSCRIBE packet containing a topic with\na extremely deep hierarchy (CVE-2019-11779).\n","status":"published","published":"2019-11-30T13:06:06Z","modified":"2026-04-16T04:42:10.541991465Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2019:2206-1","title":"Security update for mosquitto","description":"This update for mosquitto fixes the following issues:\n\n- CVE-2019-11779: Fixed insufficient parsing of SUBSCRIBE packets that could lead to a stack overflow (bsc#1151494).\n","status":"published","published":"2019-09-28T10:21:13Z","modified":"2026-02-04T02:39:02.799318Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2247-1","title":"Security update for mosquitto","description":"This update for mosquitto fixes the following issues:\n\n- CVE-2019-11779: Fixed insufficient parsing of SUBSCRIBE packets that could lead to a stack overflow (bsc#1151494).\n\nThis update was imported from the openSUSE:Leap:15.1:Update update project.","status":"published","published":"2019-10-03T16:21:06Z","modified":"2026-02-04T02:32:43.663318Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:11057-1","title":"libmosquitto1-2.0.11-1.2 on GA media","description":"These are all security issues fixed in the libmosquitto1-2.0.11-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:24:30.951191Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}