-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/eclipse/paho.mqtt.golang | go | < 1.5.1 | 1.5.1 |
Miggo AIRoot Cause AnalysisThe vulnerability, identified as CVE-2025-10543, is a numeric truncation error (CWE-197) within the eclipse/paho.mqtt.golang library. When an application uses this library to send an MQTT packet containing a string field (like a topic or client ID) longer than 65,535 bytes, the packet is improperly encoded. The root cause was identified by analyzing the patch provided in pull request #714, specifically commit 3162447fa892038e82256e918b681dc0c63a21ff. The changes in packets/packets.go pinpoint the packets.encodeBytes function as the source of the vulnerability. Before the patch, this function would calculate a 16-bit length for the data, which would truncate if the data was longer than 65,535 bytes. However, it would then write the full, untruncated data to the wire. The fix involves adding a check to truncate the data to 65,535 bytes if it exceeds this length, ensuring the encoded length matches the actual data length. Therefore, during exploitation, the packets.encodeBytes function would be present in any runtime profile or stack trace when a malicious, oversized string is being processed to create an MQTT packet.
packets.encodeBytespackets/packets.go