This project follows the Eclipse Vulnerability Reporting Policy. Vulnerabilities are tracked by the Eclipse security team, in cooperation with the project lead. Fixing vulnerabilities is taken care of by the project committers, with assistance and guidance of the security team.
Eclipse Paho provides security updates for the two most recent version only.
We recommend that in case of suspected vulnerabilities you do not create a GitHub issue, but instead contact the Eclipse Security Team directly sending an email to security@eclipse.org.