Update module github.com/eclipse/paho.mqtt.golang to v1.5.1 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/eclipse/paho.mqtt.golang	v1.5.0 → v1.5.1

---

Eclipse Paho Go MQTT may incorrectly encode strings if length exceeds 65535 bytes

CVE-2025-10543 / GHSA-32fw-gq77-f2f2

More information

Details

In Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0 UTF-8 encoded strings, passed into the library, may be incorrectly encoded if their length exceeds 65535 bytes. This may lead to unexpected content in packets sent to the server (for example, part of an MQTT topic may leak into the message body in a PUBLISH packet).

The issue arises because the length of the data passed in was converted from an int64/int32 (depending upon CPU) to an int16 without checks for overflows. The int16 length was then written, followed by the data (e.g. topic). This meant that when the data (e.g. topic) was over 65535 bytes then the amount of data written exceeds what the length field indicates. This could lead to a corrupt packet, or mean that the excess data leaks into another field (e.g. topic leaks into message body).

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-10543
• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/254
• https://github.com/eclipse-paho/paho.mqtt.golang/issues/730
• https://github.com/eclipse-paho/paho.mqtt.golang/pull/714
• https://github.com/alpinelinux/build-server-status/commit/e3487897db32c8c3d0287643f8384a6669e93731
• https://github.com/advisories/GHSA-32fw-gq77-f2f2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

eclipse/paho.mqtt.golang (github.com/eclipse/paho.mqtt.golang)

v1.5.1

Compare Source

This is a minor release incorporating changes made in the 14 months since v1.5.0 (including updating dependencies, and raising the Go version to 1.24). The changes are relatively minor but address a potential security issue (CVE-2025-10543), possible panic, enable users to better monitor the connection status, and incorporate a few optimisations.

Thanks to those who have provided fixes/enhancements included in this release!

Special thanks to Paul Gerste at Sonar for reporting issue #​730 via the Eclipse security team (fix was implemented in PR #​714 in May, github issue created just prior to this release). This issue arose where a topic > 65535 bytes was passed to the Publish function, due to the way the data was encoded the topic could leak into the message body. Please see issue #​730 or CVE-2025-10543 for further details.

What's Changed

• Updating go dependencies from pub and sub into the containers before building by @​JefJrFigueiredo in eclipse-paho#691
• Optimize TCP connection logic by @​geekeryy in eclipse-paho#713
• Fields over 65535 bytes not encoded correctly by @​MattBrittan in eclipse-paho#714
• Reduce slice allocations in route dispatch by @​alespour in eclipse-paho#710
• Add a ConnectionNotificationHandler by @​RangelReale in eclipse-paho#727
• Potential panic when using manual ACK by @​MattBrittan in eclipse-paho#729

Full Changelog: eclipse-paho/paho.mqtt.golang@v1.5.0...v1.5.1

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated

Details:

Package	Change
golang.org/x/net	v0.33.0 -> v0.44.0
golang.org/x/sync	v0.7.0 -> v0.17.0

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated

Details:

Package	Change
golang.org/x/net	v0.33.0 -> v0.44.0
golang.org/x/sync	v0.7.0 -> v0.17.0