{"action":"Upgrade github.com/eclipse/paho.mqtt.golang to 1.5.1 or later.","affected":[{"fixed":"1.5.1","introduced":"0"}],"component":"github.com/eclipse/paho.mqtt.golang","cve_ids":["CVE-2025-10543"],"ecosystem":"Go","epss":0.00227,"exploited":false,"fixed_versions":["1.5.1"],"ghsa_id":"GHSA-32fw-gq77-f2f2","id":"tcs_01M5KGC230K91QR6Q4MJGWW43T","modified_at":"2026-02-04T03:35:12.277720Z","published_at":"2025-12-15T20:37:41Z","references":["https://osv.dev/vulnerability/GO-2025-4173","https://github.com/advisories/GHSA-32fw-gq77-f2f2","https://github.com/alpinelinux/build-server-status/commit/e3487897db32c8c3d0287643f8384a6669e93731","https://github.com/eclipse-paho/paho.mqtt.golang/issues/730","https://github.com/eclipse-paho/paho.mqtt.golang/pull/714","https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/254"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GO-2025-4173","url":"https://osv.dev/vulnerability/GO-2025-4173"},{"source":"nvd","source_id":"CVE-2025-10543","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10543"}],"summary":"Eclipse Paho Go MQTT may incorrectly encode strings if length exceeds 65535 bytes in github.com/eclipse/paho.mqtt.golang"}