Memory Leak Vulnerability in Eclipse Mosquitto MQTT Broker
CVE-2021-34431

6.5MEDIUM

Key Information:

Vendor

The Eclipse Foundation

Status
Eclipse Mosquitto
Vendor
CVE Published:
22 July 2021

What is CVE-2021-34431?

In versions 1.6 to 2.0.10 of the Eclipse Mosquitto MQTT broker, an authenticated client connected via MQTT v5 can exploit a crafted CONNECT message, leading to a memory leak. This vulnerability may enable attackers to execute a Denial of Service (DoS) attack against the broker, impacting its performance and availability. Users are advised to update to the latest patched version to mitigate this risk.

Affected Version(s)

Eclipse Mosquitto 1.6

Eclipse Mosquitto <= 2.0.10

References

https://bugs.eclipse.org/bugs/show_bug.cgi?id=573191
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks to Kathrin Kleinhammer of OTARIS Interactive Services GmbH for discovering and reporting this issue.
.