Listen to this Post
How the CVE Works:
The vulnerability is in the packet encoding logic of the Eclipse Paho Go MQTT client library (v3.1). When preparing MQTT packets (e.g., a PUBLISH packet), the library must write a string field, such as a topic name, preceded by its length. The library accepts strings as `string` or `[]byte` types, which have lengths represented as 64-bit or 32-bit integers (int). However, the encoding function incorrectly casts this length to a signed 16-bit integer (int16) before writing it to the packet. The `int16` type has a maximum positive value of 32,767. For any string exceeding 65,535 bytes, this cast causes an integer overflow, resulting in a small, incorrect length value being written. The library then writes the full string data after this incorrect length header. This corrupts the packet structure, causing the broker to misinterpret packet boundaries. For example, excess bytes from an overly long topic string can overflow into and corrupt the subsequent message payload field.
Platform: Go library
Version: <=1.5.0
Vulnerability: Integer overflow
Severity: Moderate
date: 2025-12-02
Prediction: 2025-12-16
What Undercode Say:
Simulating long string input
go run -x ./cmd -topic $(python3 -c "print('A'70000)")
// Code snippet showing the vulnerable cast
func writeString(buf []byte, s string) int {
length := len(s) // int (64-bit on 64-bit systems)
binary.BigEndian.PutUint16(buf, uint16(length)) // Dangerous cast
copy(buf[2:], s)
return length + 2
}
How Exploit:
An attacker controlling a malicious MQTT broker or able to manipulate client input (e.g., topic names) could craft a string longer than 65535 bytes. When the client connects or publishes, the library encodes this string, creating a malformed packet. This could cause parsing issues on the receiving end, potentially leading to topic data leaking into the message body, corrupting messages, or causing client/broker crashes due to protocol violations.
Protection from this CVE:
Update to v1.5.1.
Validate topic length.
Use network segmentation.
Impact:
Message corruption.
Protocol violation.
Denial-of-service.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
