CVE-2019-11778

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-09-18 · updated 2026-06-17
Weakness: CWE-416

Description

If an MQTT v5 client connects to Eclipse Mosquitto versions 1.6.0 to 1.6.4 inclusive, sets a last will and testament, sets a will delay interval, sets a session expiry interval, and the will delay interval is set longer than the session expiry interval, then a use after free error occurs, which has the potential to cause a crash in some situations.

Affected products

The Eclipse Foundation Eclipse Mosquitto: from 1.6 before 1.6.5 — fixed in 1.6.5

How to fix

Upgrade to a fixed version: The Eclipse Foundation Eclipse Mosquitto 1.6.5. Check the vendor advisory for mitigations.

References

https://bugs.eclipse.org/bugs/show_bug.cgi?id=551162
https://bugs.eclipse.org/bugs/show_bug.cgi?id=551162

Get alerted when CVE-2019-11778 or the next vulnerability affects your stack