CVE-2023-5632 - CVE House
Back to Database
Status published High CVE-2023-5632

Unconditionally adding an event to the epoll causes excessive CPU consumption

Vulnerability Description

In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of service type attack. This issue is fixed in 2.0.6

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-5632

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Przemysław Zygmunt (acsoftware.pl)

References

More from Eclipse

View All →
CVE-2023-3592
In Mosquitto before 2.0.16, a memory leak occurs when clients...
Medium 5.8
CVE-2023-0809
In Mosquitto before 2.0.16, excessive memory is allocated based on...
Medium 5.8
CVE-2021-38443
Eclipse CycloneDDS Improper Handling of Syntactically Invalid Structure
Medium 6.6
CVE-2021-38441
Eclipse CycloneDDS Write-what-where Condition
Medium 6.6

Affected Vendor

Affected Software

Mosquitto
Vulnerable Versions:
0

Timeline

Official Publish: October 18th, 2023
Last Modified: September 13th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-834

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.