Medium
Security advisory
In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-11779
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 06:13 UTC · Revision 1
Source evidence
In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur.
osv:CVE-2019-11779
Complete source record
{
"id": "40d082b565c7430fe49e6942571e2edd35a48751fff0f99e51b96abd90abd312",
"url": "https://osv.dev/vulnerability/CVE-2019-11779",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-11779",
"summary": "In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur.",
"evidence": "osv:CVE-2019-11779",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2019-11779",
"aliases": [
"CVE-2019-11779"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/eclipse-mosquitto/mosquitto",
"type": "GIT",
"events": [
{
"introduced": "5e60136449d678948520085985d7e7f91f9e601c"
},
{
"fixed": "f47b56583149850f69c684130170753944ea9c93"
},
{
"introduced": "4555ee79e513d9a6dc5c13d527c56cb2cfdd24d0"
},
{
"fixed": "8c9e448d5c8c79e6c8b49655c7dd4a64e5b3ca54"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:eclipse:mosquitto:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.5"
},
{
"fixed": "1.5.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:eclipse:mosquitto:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.6"
},
{
"fixed": "1.6.6"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v1.5.8",
"v1.6.5",
"v1.6.4",
"v1.6.3",
"v1.6.2",
"v1.6.1",
"v1.6",
"v1.5.7",
"v1.5.5",
"v1.5.4",
"v1.5.3",
"v1.5.2",
"v1.5.1",
"v1.5"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-11779.json"
}
}
],
"modified": "2026-10-24T10:30:37.097860531Z",
"provider": "osv",
"references": [
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4WMHIM64Q35NGTR6R3ILZUL4MA4ANB5/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HFWQBNFTAVHPUYNGYO2TCPF5PCSWC2Z7/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWNVTFA2CKXERXRYPYE2YFTZP4GNBGYY/",
"https://bugs.eclipse.org/bugs/show_bug.cgi?id=551160",
"https://lists.debian.org/debian-lts-announce/2019/10/msg00035.html",
"https://seclists.org/bugtraq/2019/Nov/25",
"https://usn.ubuntu.com/4137-1/",
"https://www.debian.org/security/2019/dsa-4570"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*"
],
"vendor_product": "canonical:ubuntu_linux",
"extracted_events": [
{
"range": [
{
"introduced": "19.04"
},
{
"last_affected": "19.04"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
},
{
"introduced": "10.0"
},
{
"last_affected": "10.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*"
],
"vendor_product": "fedoraproject:fedora",
"extracted_events": [
{
"range": [
{
"introduced": "29"
},
{
"last_affected": "29"
},
{
"introduced": "30"
},
{
"last_affected": "30"
},
{
"introduced": "31"
},
{
"last_affected": "31"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*"
],
"vendor_product": "opensuse:backports_sle",
"extracted_events": [
{
"range": [
{
"introduced": "15.0-sp1"
},
{
"last_affected": "15.0-sp1"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"
],
"vendor_product": "opensuse:leap",
"extracted_events": [
{
"range": [
{
"introduced": "15.1"
},
{
"last_affected": "15.1"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2019-11779",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 434134,
"published_at": "2019-09-19T14:15:10.573+00:00"
}