{"action":"Upgrade github.com/eclipse/paho.mqtt.golang to 1.5.1 or later.","affected":[{"fixed":"1.5.1","introduced":"0"}],"component":"github.com/eclipse/paho.mqtt.golang","cve_ids":["CVE-2025-10543"],"ecosystem":"Go","epss":0.00227,"exploited":false,"fixed_versions":["1.5.1"],"ghsa_id":"GHSA-32fw-gq77-f2f2","id":"tcs_01M5KESYK6B1W49P699QDZE2M5","modified_at":"2026-09-10T03:50:31.188557268Z","published_at":"2025-12-02T09:30:26Z","references":["https://osv.dev/vulnerability/GHSA-32fw-gq77-f2f2","https://nvd.nist.gov/vuln/detail/CVE-2025-10543","https://github.com/eclipse-paho/paho.mqtt.golang/issues/730","https://github.com/eclipse-paho/paho.mqtt.golang/pull/714","https://github.com/alpinelinux/build-server-status/commit/e3487897db32c8c3d0287643f8384a6669e93731","https://github.com/advisories/GHSA-32fw-gq77-f2f2","https://github.com/eclipse-paho/paho.mqtt.golang","https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/254"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-32fw-gq77-f2f2","url":"https://osv.dev/vulnerability/GHSA-32fw-gq77-f2f2"},{"source":"nvd","source_id":"CVE-2025-10543","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10543"}],"summary":"Eclipse Paho Go MQTT may incorrectly encode strings if length exceeds 65535 bytes"}