CVE-2023-28366 Denial of service in n/a

What is CVE-2023-28366?

CVE-2023-28366 is a high-severity denial of service vulnerability in n/a, published on 1 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 messages with duplicate message IDs, and fails to respond to PUBREC commands. This occurs because of mishandling of EAGAIN from the libc send function.

Weakness: CWE-401

Which versions are affected by CVE-2023-28366?

It affects 1 product.

Products include Eclipse Mosquitto.

How do I fix CVE-2023-28366?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-28366 being exploited?

There is no known exploitation of CVE-2023-28366 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2018-12550 Auth bypass in Eclipse Mosquitto High 8.1
• CVE-2018-12551 Auth bypass in Eclipse Mosquitto High 8.1
• CVE-2023-5632 Unconditionally adding an event to the epoll causes excessive CPU consumption High 7.5
• CVE-2021-41039 Denial of service in Eclipse Mosquitto High 7.5
• CVE-2021-34432 Denial of service in Eclipse Mosquitto High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2023-28366, DEBIAN-CVE-2023-28366, GHSA-897v-899r-j3hg, MGASA-2025-0106, OESA-2023-1658, OESA-2023-1659 and 2 more.