CVE-2025-10543
Description
In Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0 UTF-8 encoded strings, passed into the library, may be incorrectly encoded if their length exceeds 65535 bytes. This may lead to unexpected content in packets sent to the server (for example, part of an MQTT topic may leak into the message body in a PUBLISH packet).
The issue arises because the length of the data passed in was converted from an int64/int32 (depending upon CPU) to an int16 without checks for overflows. The int16 length was then written, followed by the data (e.g. topic). This meant that when the data (e.g. topic) was over 65535 bytes then the amount of data written exceeds what the length field indicates. This could lead to a corrupt packet, or mean that the excess data leaks into another field (e.g. topic leaks into message body).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Integer overflow in Eclipse Paho Go MQTT library allows packet corruption or data leakage when strings exceed 65535 bytes.
Root
Cause
The vulnerability resides in the Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions up to and including 1.5.0. When encoding UTF-8 strings (e.g., topic names) into MQTT packets, the library converts the string length from an int64 or int32 (depending on CPU architecture) to an int16 without performing any overflow checks [1][2]. If the string length exceeds 65535 bytes, the truncated int16 value is written as the length field, followed by the full string data. This mismatch causes the packet to be malformed: the length field indicates fewer bytes than actually follow, so the excess data spills into subsequent packet fields.
Exploitation
An attacker who can control the content of a UTF-8 string passed to the library—for example, by publishing a message with an overly long topic—can trigger the overflow. No special privileges are required beyond the ability to send MQTT operations to a client using the vulnerable library [3]. The attack surface is network-based, as the library is used to communicate with MQTT brokers. The overflow occurs during packet construction, before the packet is sent over the wire.
Impact
Successful exploitation leads to corrupt MQTT packets. In the specific case of a PUBLISH packet, the excess bytes from a long topic can leak into the message body field, potentially exposing data that was intended to be part of the topic [2]. This could result in information disclosure or unexpected behavior on the broker or other subscribers. The integrity of the MQTT communication is compromised.
Mitigation
The issue has been addressed in version 1.5.1 of the library [4]. Users are strongly advised to update to this or a later version. No workarounds are documented; the safest remediation is to upgrade the dependency. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog.
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/eclipse/paho.mqtt.golangGo | < 1.5.1 | 1.5.1 |
Affected products
2- Range: <=1.5.0
- Eclipse Foundation/paho.mqtt.golang (Go MQTT v3.1 library)v5Range: 0
Patches
1e3487897db32merge: deps: update module github.com/eclipse/paho.mqtt.golang to v1.5.1
3 files changed · +16 −14
backend/Dockerfile+1 −1 modified@@ -1,4 +1,4 @@ -FROM alpinelinux/golang:edge as builder +FROM registry.alpinelinux.org/alpine/infra/docker/golang:3.22 AS builder COPY --chown=build ./ /src
backend/go.mod+7 −5 modified@@ -1,9 +1,11 @@ module gitlab.alpinelinux.org/alpine/infra/build-server-status/backend -go 1.18 +go 1.24.0 + +toolchain go1.24.9 require ( - github.com/eclipse/paho.mqtt.golang v1.5.0 + github.com/eclipse/paho.mqtt.golang v1.5.1 github.com/gorilla/websocket v1.5.3 github.com/rs/zerolog v1.33.0 github.com/spf13/pflag v1.0.10 @@ -15,8 +17,8 @@ require ( github.com/mattn/go-colorable v0.1.13 // indirect github.com/mattn/go-isatty v0.0.19 // indirect github.com/pmezard/go-difflib v1.0.0 // indirect - golang.org/x/net v0.27.0 // indirect - golang.org/x/sync v0.7.0 // indirect - golang.org/x/sys v0.22.0 // indirect + golang.org/x/net v0.44.0 // indirect + golang.org/x/sync v0.17.0 // indirect + golang.org/x/sys v0.36.0 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect )
backend/go.sum+8 −8 modified@@ -1,8 +1,8 @@ github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/eclipse/paho.mqtt.golang v1.5.0 h1:EH+bUVJNgttidWFkLLVKaQPGmkTUfQQqjOsyvMGvD6o= -github.com/eclipse/paho.mqtt.golang v1.5.0/go.mod h1:du/2qNQVqJf/Sqs4MEL77kR8QTqANF7XU7Fk0aOTAgk= +github.com/eclipse/paho.mqtt.golang v1.5.1 h1:/VSOv3oDLlpqR2Epjn1Q7b2bSTplJIeV2ISgCl2W7nE= +github.com/eclipse/paho.mqtt.golang v1.5.1/go.mod h1:1/yJCneuyOoCOzKSsOTUc0AJfpsItBGWvYpBLimhArU= github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA= github.com/gorilla/websocket v1.5.3 h1:saDtZ6Pbx/0u+bgYQ3q96pZgCzfhKXGPqt7kZ72aNNg= github.com/gorilla/websocket v1.5.3/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE= @@ -21,15 +21,15 @@ github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA= github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY= -golang.org/x/net v0.27.0 h1:5K3Njcw06/l2y9vpGCSdcxWOYHOUk3dVNGDXN+FvAys= -golang.org/x/net v0.27.0/go.mod h1:dDi0PyhWNoiUOrAS8uXv/vnScO4wnHQO4mj9fn/RytE= -golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M= -golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= +golang.org/x/net v0.44.0 h1:evd8IRDyfNBMBTTY5XRF1vaZlD+EmWx6x8PkhR04H/I= +golang.org/x/net v0.44.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY= +golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug= +golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.22.0 h1:RI27ohtqKCnwULzJLqkv897zojh5/DwS/ENaMzUOaWI= -golang.org/x/sys v0.22.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= +golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k= +golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
6- github.com/advisories/GHSA-32fw-gq77-f2f2ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-10543ghsaADVISORY
- github.com/alpinelinux/build-server-status/commit/e3487897db32c8c3d0287643f8384a6669e93731ghsaWEB
- github.com/eclipse-paho/paho.mqtt.golang/issues/730ghsaWEB
- github.com/eclipse-paho/paho.mqtt.golang/pull/714ghsaWEB
- gitlab.eclipse.org/security/vulnerability-reports/-/issues/254ghsaWEB
News mentions
0No linked articles in our index yet.