CVE-2019-11779

In Eclipse Mosquitto 1.5.0 to 1.6.5 inclusive, if a malicious MQTT client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur.

• CWE-754
• CWE-674

• https://lists.opensuse.org/opensuse-security-announce/2019-09/msg00077.htmlMailing List, Third Party Advisory
• https://lists.opensuse.org/opensuse-security-announce/2019-10/msg00008.htmlMailing List, Third Party Advisory
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=551160Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2019/10/msg00035.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4WMHIM64Q35NGTR6R3ILZUL4MA4ANB5/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HFWQBNFTAVHPUYNGYO2TCPF5PCSWC2Z7/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWNVTFA2CKXERXRYPYE2YFTZP4GNBGYY/
• https://seclists.org/bugtraq/2019/Nov/25Mailing List, Third Party Advisory
• https://usn.ubuntu.com/4137-1/Third Party Advisory
• https://www.debian.org/security/2019/dsa-4570Third Party Advisory
• https://lists.opensuse.org/opensuse-security-announce/2019-09/msg00077.htmlMailing List, Third Party Advisory
• https://lists.opensuse.org/opensuse-security-announce/2019-10/msg00008.htmlMailing List, Third Party Advisory
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=551160Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2019/10/msg00035.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4WMHIM64Q35NGTR6R3ILZUL4MA4ANB5/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HFWQBNFTAVHPUYNGYO2TCPF5PCSWC2Z7/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JWNVTFA2CKXERXRYPYE2YFTZP4GNBGYY/
• https://seclists.org/bugtraq/2019/Nov/25Mailing List, Third Party Advisory
• https://usn.ubuntu.com/4137-1/Third Party Advisory
• https://www.debian.org/security/2019/dsa-4570Third Party Advisory

Published

Sep 19, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11773Prior to 0.1, AIX builds of Eclipse OMR contain unused RPATH…7.8
• CVE-2019-11774Prior to 0.1, all builds of Eclipse OMR contain a bug where …7.4
• CVE-2019-11775All builds of Eclipse OpenJ9 prior to 0.15 contain a bug whe…7.4
• CVE-2019-11776In Eclipse BIRT versions 1.0 to 4.7, the Report Viewer allow…6.1
• CVE-2019-11777In the Eclipse Paho Java client library version 1.2.0, when …7.5
• CVE-2019-11778If an MQTT v5 client connects to Eclipse Mosquitto versions …5.4
• CVE-2019-1178An elevation of privilege vulnerability exists in the way th…7
• CVE-2019-11780Improper access control in the computed fields system of the…8.1
• CVE-2019-11781Improper input validation in portal component in Odoo Commun…8.8
• CVE-2019-11782Improper access control in Odoo Community 14.0 and earlier a…6.5
• CVE-2019-11783Improper access control in mail module (channel partners) in…6.5
• CVE-2019-11784Improper access control in mail module (notifications) in Od…6.5