CVE-2017-7653

CVE-2017-7653

Vendor The Eclipse Foundation
Product Eclipse Mosquitto
Weakness CWE-20 · Input validation
Published June 5, 2018
Last update August 5, 2024

CVSS base score

What the vulnerability does

01Description

The Eclipse Mosquitto broker up to version 1.4.15 does not reject strings that are not valid UTF-8. A malicious client could cause other clients that do reject invalid UTF-8 strings to disconnect themselves from the broker by sending a topic string which is not valid UTF-8, and so cause a denial of service for the clients.

Key dates

02Disclosure timeline

June 5, 2018 CVE published
August 5, 2024 Record updated