CVE-2025-10543
📋 TL;DR
This vulnerability in Eclipse Paho Go MQTT library allows UTF-8 strings longer than 65535 bytes to be incorrectly encoded, potentially causing packet corruption or data leakage between fields. It affects applications using paho.mqtt.golang v1.5.0 and earlier. The issue occurs due to integer overflow when converting data length from int64/int32 to int16 without proper bounds checking.
💻 Affected Systems
- Eclipse Paho Go MQTT client library (paho.mqtt.golang)
📦 What is this software?
Paho Mqtt by Eclipse
⚠️ Risk & Real-World Impact
Worst Case
MQTT packets become corrupted causing message loss, or sensitive topic information leaks into message payloads visible to unauthorized subscribers.
Likely Case
Packet corruption leading to message delivery failures or unexpected application behavior when processing malformed MQTT packets.
If Mitigated
Limited impact with proper input validation and length checking implemented at application layer.
🎯 Exploit Status
Exploitation requires sending specially crafted MQTT packets with very long UTF-8 strings. No authentication needed but requires ability to send packets to vulnerable MQTT client.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.5.1 or later
Vendor Advisory: https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/254
Restart Required: Yes
Instructions:
1. Update Go dependencies: go get github.com/eclipse/paho.mqtt.golang@v1.5.1
2. Update go.mod to require v1.5.1+
3. Rebuild and redeploy application
4. Restart all services using the library
🔧 Temporary Workarounds
Input validation at application layer
allImplement length checking for all UTF-8 strings before passing to MQTT library
// Go code example:
if len(topic) > 65535 {
return errors.New("topic too long")
}
if len(payload) > 65535 {
return errors.New("payload too long")
}
🧯 If You Can't Patch
- Implement network filtering to block MQTT packets with strings exceeding 65535 bytes
- Deploy MQTT brokers with payload size restrictions and monitor for oversized packets
🔍 How to Verify
Check if Vulnerable:
Check go.mod or go.sum for paho.mqtt.golang dependency version <=1.5.0Check Version:
grep 'github.com/eclipse/paho.mqtt.golang' go.modVerify Fix Applied:
Verify go.mod requires github.com/eclipse/paho.mqtt.golang v1.5.1+ and check imported version in code📡 Detection & Monitoring
Log Indicators:
- MQTT connection errors
- Packet parsing failures
- Unexpected disconnections
Network Indicators:
- MQTT packets with UTF-8 strings exceeding 65535 bytes
- Malformed MQTT PUBLISH packets
SIEM Query:
source="mqtt_broker" AND (packet_size>65535 OR error="parse_error")