CVE-2025-10543
Eclipse Paho Go MQTT Integer Overflow Vulnerability
Description
In Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0 UTF-8 encoded strings, passed into the library, may be incorrectly encoded if their length exceeds 65535 bytes. This may lead to unexpected content in packets sent to the server (for example, part of an MQTT topic may leak into the message body in a PUBLISH packet). The issue arises because the length of the data passed in was converted from an int64/int32 (depending upon CPU) to an int16 without checks for overflows. The int16 length was then written, followed by the data (e.g. topic). This meant that when the data (e.g. topic) was over 65535 bytes then the amount of data written exceeds what the length field indicates. This could lead to a corrupt packet, or mean that the excess data leaks into another field (e.g. topic leaks into message body).
INFO
Published Date :
Dec. 2, 2025, 9:15 a.m.
Last Modified :
Oct. 18, 2026, 6:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 4.0 | MEDIUM | e51fbebd-6053-4e49-959f-1b94eeb69a2c | ||||
| CVSS 4.0 | MEDIUM | [email protected] |
Solution
- Update Eclipse Paho Go MQTT library to a non-vulnerable version.
- Verify UTF-8 encoding and packet integrity after update.
- Review MQTT topic and message handling logic.
Public PoC/Exploit Available at Github
CVE-2025-10543 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-10543.
| URL | Resource |
|---|---|
| https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/254 | Issue Tracking Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-10543 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-10543
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
This software will connect to a pub/sub broker used by Chirpstack, subscribe to the device message topic and forward this message to a Azure IoT Hub.
Python Shell Dockerfile
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-10543 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-10543 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 18, 2026
Action Type Old Value New Value Added Translation Title: paho.mqtt.golang (Go MQTT v3.1 library) de Eclipse Foundation, Description: En las versiones menor o igual que 1.5.0 de la biblioteca Eclipse Paho Go MQTT v3.1 (paho.mqtt.golang), las cadenas codificadas en UTF-8, pasadas a la biblioteca, pueden codificarse incorrectamente si su longitud excede los 65535 bytes. Esto puede llevar a contenido inesperado en los paquetes enviados al servidor (por ejemplo, parte de un tema MQTT puede filtrarse en el cuerpo del mensaje en un paquete PUBLISH). El problema surge porque la longitud de los datos pasados se convirtió de un int64/int32 (dependiendo de la CPU) a un int16 sin comprobaciones de desbordamientos. La longitud int16 se escribió entonces, seguida de los datos (por ejemplo, el tema). Esto significaba que cuando los datos (por ejemplo, el tema) superaban los 65535 bytes, entonces la cantidad de datos escritos excedía lo que indicaba el campo de longitud. Esto podría llevar a un paquete corrupto, o significar que el exceso de datos se filtra en otro campo (por ejemplo, el tema se filtra en el cuerpo del mensaje). -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'Eclipse Foundation', 'product': 'paho.mqtt.golang (Go MQTT v3.1 library)', 'versions': [{'status': 'affected', 'version': '0', 'versionType': 'semver', 'lessThanOrEqual': '1.5.0'}], 'defaultStatus': 'unaffected'}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2025-10543', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2025-12-02T13:55:40.279700Z'} -
Initial Analysis by [email protected]
Jan. 16, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Added CPE Configuration OR *cpe:2.3:a:eclipse:paho_mqtt:*:*:*:*:*:go:*:* versions up to (including) 1.5.0 Added Reference Type Eclipse Foundation: https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/254 Types: Issue Tracking, Vendor Advisory -
New CVE Received by [email protected]
Dec. 02, 2025
Action Type Old Value New Value Added Description In Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0 UTF-8 encoded strings, passed into the library, may be incorrectly encoded if their length exceeds 65535 bytes. This may lead to unexpected content in packets sent to the server (for example, part of an MQTT topic may leak into the message body in a PUBLISH packet). The issue arises because the length of the data passed in was converted from an int64/int32 (depending upon CPU) to an int16 without checks for overflows. The int16 length was then written, followed by the data (e.g. topic). This meant that when the data (e.g. topic) was over 65535 bytes then the amount of data written exceeds what the length field indicates. This could lead to a corrupt packet, or mean that the excess data leaks into another field (e.g. topic leaks into message body). Added CVSS V4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-197 Added CWE CWE-681 Added Reference https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/254