In Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0 UTF-8 encoded strings, passed into the library, may be incorrectly encoded if their length exceeds 65535 bytes. This may lead to unexpected content in packets sent to the server (for example, part of an MQTT topic may leak into the message body in a PUBLISH packet). The issue arises because the length of the data passed in was converted from an int64/int32 (depending upon CPU) to an int16 without checks for overflows. The int16 length was then written, followed by the data (e.g. topic). This meant that when the data (e.g. topic) was over 65535 bytes then the amount of data written exceeds what the length field indicates. This could lead to a corrupt packet, or mean that the excess data leaks into another field (e.g. topic leaks into message body).

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-89758d1b13 advisory.

    Update to 0.2.8

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-34b0986502 advisory.

    Update to 0.2.8

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0 UTF-8 encoded strings, passed     into the library, may be incorrectly encoded if their length exceeds 65535 bytes. This may lead to     unexpected content in packets sent to the server (for example, part of an MQTT topic may leak into the     message body in a PUBLISH packet). The issue arises because the length of the data passed in was converted     from an int64/int32 (depending upon CPU) to an int16 without checks for overflows. The int16 length was     then written, followed by the data (e.g. topic). This meant that when the data (e.g. topic) was over 65535     bytes then the amount of data written exceeds what the length field indicates. This could lead to a     corrupt packet, or mean that the excess data leaks into another field (e.g. topic leaks into message     body). (CVE-2025-10543)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
279448	Fedora 43 : mqttcli (2025-89758d1b13)	Nessus	Fedora Local Security Checks	medium
279447	Fedora 42 : mqttcli (2025-34b0986502)	Nessus	Fedora Local Security Checks	medium
278964	Linux Distros Unpatched Vulnerability : CVE-2025-10543	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-10543

medium

Tenable Plugins

medium

medium

medium