Detections
Analytics

SCA: security update for github.com/eclipse/paho.mqtt.golang (GHSA-32fw-gq77-f2f2)

medium Tenable Cloud Security Plugin ID 436186

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0 UTF-8 encoded strings, passed
 into the library, may be incorrectly encoded if their length exceeds 65535 bytes. This may lead to
 unexpected content in packets sent to the server (for example, part of an MQTT topic may leak into the
 message body in a PUBLISH packet). The issue arises because the length of the data passed in was converted
 from an int64/int32 (depending upon CPU) to an int16 without checks for overflows. The int16 length was
 then written, followed by the data (e.g. topic). This meant that when the data (e.g. topic) was over 65535
 bytes then the amount of data written exceeds what the length field indicates. This could lead to a
 corrupt packet, or mean that the excess data leaks into another field (e.g. topic leaks into message
 body). (CVE-2025-10543)

See Also

https://github.com/advisories/GHSA-32fw-gq77-f2f2

Plugin Details

Severity: Medium

ID: 436186

Version: Revision 1.10

Type: Local

Family: SCA Checks

Published: 12/2/2025

Updated: 6/30/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2025-10543

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.3

Threat Score: 1.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 12/2/2025

Vulnerability Publication Date: 12/2/2025

Reference Information

CVE: CVE-2025-10543

cwe: CWE-197