CVE-2025-12790 Rubygem-mqtt: rubygem-mqtt hostname validation
The Ruby MQTT library lacked hostname validation by default, allowing attackers to perform Man-in-the-Middle attacks against MQTT connections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-12790?
CVE-2025-12790 is a high-severity vulnerability in Nicholas J Humfrey Red Hat Satellite 6, published on 6 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in Rubygem MQTT. By default, the package used to not have hostname validation, resulting in possible Man-in-the-Middle (MITM) attack.
Weakness: CWE-29
Which versions are affected by CVE-2025-12790?
2 open source packages ship an affected version, including mqtt.
| Package | Affected | Fixed in |
|---|---|---|
mqtt RubyGems | All versions | 0.7.0 |
mqtt RubyGems | All versions | 0.7.0 |
How do I fix CVE-2025-12790?
Upgrade mqtt to 0.7.0 or later.
Is CVE-2025-12790 being exploited?
There is no known exploitation of CVE-2025-12790 in the wild and no public exploit code.
Sources
Also known as GHSA-9c5q-w6gr-fxcq.