CVE-2025-10543
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
In Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0, UTF-8 encoded strings passed into the library may be incorrectly encoded if their length exceeds 65535 bytes. This may lead to unexpected content in packets sent to the server (e.g., part of an MQTT topic may leak into the message body in a PUBLISH packet). The issue arises because the data length was converted from int64/int32 to int16 without overflow checks.
Risk Assessment
MQTT packets may become corrupted or data may leak between fields (e.g., topic into message body), potentially causing communication errors or information disclosure to unintended recipients.
Recommendation
Update the paho.mqtt.golang library to a version later than 1.5.0. Avoid passing strings longer than 65535 bytes to the library until the update is applied.
Related vulnerabilities
- CVE-2026-114630Critical
The ELEX WordPress HelpDesk & Customer Ticketing System plugin is vulnerable to arbitrary file deletion due to insufficient file path validation in the factory_reset function in all versions up to, and including, 3.3.8. Unauthenticated attackers can delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The vulnerability is exploited via a two-step chain: storing an arbitrary ticket_attachment_path value through the public AJAX endpoint, then triggering the factory_reset routine via a GET request.
- CVE-2026-107622Critical
The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.10.5 via a form-type confusion attack through the bf_post_type parameter. Unauthenticated attackers can insert a rogue BuddyForms form configuration with an attacker-controlled new_user_role value into the live global form registry, then submit a registration through that form to create a new WordPress account with administrator-level privileges. Exploitation requires "Anyone can register" enabled and at least one public BuddyForms form attached to a page.
- CVE-2026-123294Critical
In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow.
- CVE-2026-123279Critical
In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators.
- CVE-2026-88800Critical
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce. The guard meant to protect roles with assigned users reads a different part of the request than the one selecting what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, permanently stripping every user of their capabilities.
- CVE-2026-120844Critical
Incorrect Privilege Assignment vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) through 7.1.3 allows Privilege Escalation.
- CVE-2026-119516Critical
Deserialization of Untrusted Data vulnerability in Radius Booking — Booking Calendar for Appointments & Services through 1.0.20 allows Object Injection.
- CVE-2026-118423Critical
The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions, allowing unauthenticated attackers to upload PHP files to a web-accessible location and execute them, leading to remote code execution.
- CVE-2026-116533Critical
The Static Snapshot WordPress plugin through 0.2.1 does not sanitise shell metacharacters in a user-supplied value before concatenating it into operating-system commands run by the server, allowing unauthenticated attackers to execute arbitrary commands on the host.
- CVE-2026-115230Critical
The WHIZZ WordPress plugin through 1.1.8 does not validate the password-reset key before updating a user's password, relying only on a nonce that is exposed to unauthenticated visitors, allowing attackers to set an arbitrary password for any user, including administrators, and fully take over their accounts.
Original NVD description (English source)
In Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0 UTF-8 encoded strings, passed into the library, may be incorrectly encoded if their length exceeds 65535 bytes. This may lead to unexpected content in packets sent to the server (for example, part of an MQTT topic may leak into the message body in a PUBLISH packet). The issue arises because the length of the data passed in was converted from an int64/int32 (depending upon CPU) to an int16 without checks for overflows. The int16 length was then written, followed by the data (e.g. topic). This meant that when the data (e.g. topic) was over 65535 bytes then the amount of data written exceeds what the length field indicates. This could lead to a corrupt packet, or mean that the excess data leaks into another field (e.g. topic leaks into message body).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS