{"id":"CVE-2023-5632","aliases":["BELL-CVE-2023-5632","DEBIAN-CVE-2023-5632","EUVD-2023-57925","GHSA-4jhw-x435-x5f7","OESA-2023-1772","OESA-2023-1773","OESA-2023-1774","UBUNTU-CVE-2023-5632"],"status":"published","title":"Unconditionally adding an event to the epoll causes excessive CPU consumption","description":"In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of service type attack. This issue is fixed in 2.0.6","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00803,"percentile":0.5697,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-834"],"published":"2023-10-18T08:34:34Z","modified":"2026-10-28T10:40:39Z","fixes":[{"ecosystem":"Debian:12","package":"mosquitto","fixed_in":["2.0.7-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mosquitto","fixed_in":["2.0.7-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mosquitto","fixed_in":["2.0.7-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.16-1.oe2203"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.16-1.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"mosquitto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.16-1.oe2203sp2"}]}],"bundled":2}],"products":[{"vendor":"eclipse","product":"mosquitto"},{"vendor":"eclipse foundation","product":"mosquitto"}],"references":[{"url":"https://github.com/eclipse/mosquitto/pull/2053","tags":["patch","issue-tracking","x_transferred","Issue Tracking","fix","report"]},{"url":"https://github.com/eclipse/mosquitto/commit/18bad1ff32435e523d7507e9b2ce0010124a8f2d","tags":["patch","x_transferred","Patch","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5632","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4jhw-x435-x5f7"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-5632","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5632.json","tags":["advisory"]},{"url":"https://github.com/eclipse/mosquitto","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-5632","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1772","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3592","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1773","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1774","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-5632","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-5632","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-5632","title":"Unconditionally adding an event to the epoll causes excessive CPU consumption","description":"In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of service type attack. This issue is fixed in 2.0.6\n\n\n","status":"published","published":"2023-10-18T08:34:34.788Z","modified":"2024-09-13T14:50:24.704Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-834"],"updated_at":"2026-11-02T14:35:17.149492Z"}],"euvd":[{"id":"EUVD-2023-57925","description":"In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of service type attack. This issue is fixed in 2.0.6\n\n\n","status":"published","published":"2023-10-18T08:34:34Z","modified":"2024-09-13T14:50:24Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:55:55.933062Z"}],"ghsa":[{"id":"GHSA-4jhw-x435-x5f7","title":"In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server...","description":"In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of service type attack. This issue is fixed in 2.0.6\n\n\n","status":"published","published":"2023-10-18T09:30:28Z","modified":"2024-04-04T08:46:01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-834"],"updated_at":"2026-11-02T14:57:01.229221Z"}],"nvd":[{"id":"CVE-2023-5632","description":"In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of service type attack. This issue is fixed in 2.0.6\n\n\n","status":"published","published":"2023-10-18T09:15:10.08Z","modified":"2026-06-17T06:48:58.843Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-834"],"updated_at":"2026-11-02T14:08:39.058878Z"}],"osv":[{"id":"BELL-CVE-2023-5632","title":"CVE-2023-5632 does not affect BellSoft software","status":"withdrawn","published":"2023-10-18T09:15:00Z","modified":"2026-01-26T09:46:03.06031Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:19.288949Z"},{"id":"CVE-2023-5632","title":"Unconditionally adding an event to the epoll causes excessive CPU consumption","description":"In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of service type attack. This issue is fixed in 2.0.6\n\n\n","status":"published","published":"2023-10-18T08:34:34.788Z","modified":"2026-10-28T10:40:39.917687738Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-834"],"updated_at":"2026-11-02T15:44:36.851042Z"},{"id":"DEBIAN-CVE-2023-5632","description":"In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of service type attack. This issue is fixed in 2.0.6","status":"published","published":"2023-10-18T09:15:10.08Z","modified":"2026-10-26T18:03:10.495769894Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:41.533064Z"},{"id":"OESA-2023-1772","title":"mosquitto security update","description":"Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for \u0026quot;machine to machine\u0026quot; messaging such as with low power sensors or mobile devices such as phones, embedded computers or micro-controllers like the Arduino.\r\n\r\nSecurity Fix(es):\r\n\r\nIn Mosquitto before 2.0.16, a memory leak occurs when clients send v5 CONNECT packets with a will message that contains invalid property types.\n(CVE-2023-3592)\r\n\r\nIn Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of service type attack. This issue is fixed in 2.0.6\r\n\r\n\n(CVE-2023-5632)","status":"published","published":"2023-10-28T11:06:13Z","modified":"2026-08-18T01:17:55.618523459Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"OESA-2023-1773","title":"mosquitto security update","description":"Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for \u0026quot;machine to machine\u0026quot; messaging such as with low power sensors or mobile devices such as phones, embedded computers or micro-controllers like the Arduino.\r\n\r\nSecurity Fix(es):\r\n\r\nIn Mosquitto before 2.0.16, a memory leak occurs when clients send v5 CONNECT packets with a will message that contains invalid property types.\n(CVE-2023-3592)\r\n\r\nIn Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of service type attack. This issue is fixed in 2.0.6\r\n\r\n\n(CVE-2023-5632)","status":"published","published":"2023-10-28T11:06:13Z","modified":"2026-08-18T01:17:55.586414792Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"OESA-2023-1774","title":"mosquitto security update","description":"Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for \u0026quot;machine to machine\u0026quot; messaging such as with low power sensors or mobile devices such as phones, embedded computers or micro-controllers like the Arduino.\r\n\r\nSecurity Fix(es):\r\n\r\nIn Mosquitto before 2.0.16, a memory leak occurs when clients send v5 CONNECT packets with a will message that contains invalid property types.\n(CVE-2023-3592)\r\n\r\nIn Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of service type attack. This issue is fixed in 2.0.6\r\n\r\n\n(CVE-2023-5632)","status":"published","published":"2023-10-28T11:06:13Z","modified":"2026-08-18T01:17:55.787154887Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"UBUNTU-CVE-2023-5632","description":"In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of service type attack. This issue is fixed in 2.0.6","status":"withdrawn","published":"2023-10-18T09:15:00Z","modified":"2025-07-16T07:46:39.339473Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:41.555387Z"}]}}