There is an updated pull request by ndowens against master on the void-packages repository

https://github.com/ndowens/void-packages mosquitto
https://github.com/void-linux/void-packages/pull/26499

mosquitto: update to 1.6.12
Fixes CVE-2019-11778 CVE-2019-11779

A patch file from https://github.com/void-linux/void-packages/pull/26499.patch is attached