CVE-2021-34431

Published: Jul 22, 2021Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

In Eclipse Mosquitto version 1.6 to 2.0.10, if an authenticated client that had connected with MQTT v5 sent a crafted CONNECT message to the broker a memory leak would occur, which could be used to provide a DoS attack against the broker.

Affected (1)

Products: Eclipse: Mosquitto

Eclipse

1 product

Mosquitto

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Eclipse Mosquitto	From 1.6 to 2.0.10

Related CWEs

CWE-401

Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

References (2)

https://bugs.eclipse.org/bugs/show_bug.cgi?id=573191

Source: emo@eclipse.org

Mailing ListVendor Advisory

https://bugs.eclipse.org/bugs/show_bug.cgi?id=573191

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

Timeline

No history available yet.