{"action":"Upgrade mqtt to 0.7.0 or later.","affected":[{"fixed":"0.7.0","introduced":"0"}],"component":"mqtt","cve_ids":["CVE-2025-12790"],"ecosystem":"RubyGems","epss":0.00376,"exploited":false,"fixed_versions":["0.7.0"],"ghsa_id":"GHSA-9c5q-w6gr-fxcq","id":"tcs_01M5KEJAFH9AW34JRKJJV9JYY5","modified_at":"2025-11-07T00:29:54.704188Z","published_at":"2025-11-06T21:31:31Z","references":["https://osv.dev/vulnerability/GHSA-9c5q-w6gr-fxcq","https://nvd.nist.gov/vuln/detail/CVE-2025-12790","https://access.redhat.com/security/cve/CVE-2025-12790","https://bugzilla.redhat.com/show_bug.cgi?id=2413004","https://github.com/njh/ruby-mqtt/blob/main/NEWS.md#ruby-mqtt-version-070-2025-10-29","http://github.com/njh/ruby-mqtt"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"GHSA-9c5q-w6gr-fxcq","url":"https://osv.dev/vulnerability/GHSA-9c5q-w6gr-fxcq"}],"summary":"MQTT does not validate hostnames"}