Skip to content
Sign in
Not rated

CVE-2021-34431 In Eclipse Mosquitto version 1.6 to 2.0.10, if an authenticated client that had connected with MQTT v5 sent a crafted…

Description

In Eclipse Mosquitto version 1.6 to 2.0.10, if an authenticated client that had connected with MQTT v5 sent a crafted CONNECT message to the broker a memory leak would occur, which could be used to provide a DoS attack against the broker.

Affected products and versions

Product Affected versions Fixed in
Eclipse Mosquitto 2.0 earliest → 2.0.10 No fix stated
Eclipse Mosquitto 1.6 1.6 → latest No fix stated

Other CVEs of Eclipse Mosquitto

The 16 CVEs of Eclipse Mosquitto →
CVE-2021-41039 In versions 1.6 to 2.0.11 of Eclipse Mosquitto, an MQTT v5 client connecting with a large number of user-property… Not rated CVE-2021-34434 In Eclipse Mosquitto versions 2.0 to 2.0.11, when using the dynamic security plugin, if the ability for a client to make… Not rated CVE-2021-34432 In Eclipse Mosquitto versions 2.0.7 and earlier, the server will crash if the client tries to send a PUBLISH packet with… Not rated CVE-2021-28166 In Eclipse Mosquitto version 2.0.0 to 2.0.9, if an authenticated client that had connected with MQTT v5 sent a crafted… 6.5 Medium
Track this CVE