GitHub Advisoryadvisory · RubyGems

GHSA-9c5q-w6gr-fxcq MQTT does not validate hostnames

HIGH Published 2025-11-06 Modified 2025-11-06 Official page ↗

Aliases: CVE-2025-12790
Ecosystem: RubyGems
Packages: mqtt
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses: CWE-29
Reviewed: 2025-11-06

Affected packages

• RubyGems mqtt: < 0.7.0 → fixed in 0.7.0

Description

A flaw was found in Rubygem MQTT. By default, the package used to not have hostname validation, resulting in possible Man-in-the-Middle (MITM) attack.

Alias · CVE (1)

CVE-2025-12790 A flaw was found in Rubygem MQTT. vulnerability

Weakness · CWE (1)

CWE-29 Path Traversal: '\..\filename' weakness

References