CVE catalog

CVE-2021-34431

mosquitto: CVE-2021-34431

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.11% · Oct 25, 2026

In Eclipse Mosquitto version 1.6 to 2.0.10, if an authenticated client that had connected with MQTT v5 sent a crafted CONNECT message to the broker a memory leak would occur, which could be used to provide a DoS attack against the broker.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianmosquittosid2.1.2-3fixed
Debianmosquittoforky2.1.2-3fixed
Debianmosquittotrixie2.0.21-1fixed
Debianmosquittobookworm2.0.11-1.2+deb12u2fixed
Debianmosquittobookworm-security2.0.11-1.2+deb12u1fixed
Ubuntumosquittopro1.6.6-1vulnerable
Ubuntumosquittopro1.6.7-1vulnerable
Ubuntumosquittopro1.6.8-1vulnerable
Ubuntumosquittopro1.6.8-2vulnerable
Ubuntumosquittopro1.6.9-1~build1vulnerable
Ubuntumosquittopro1.6.9-1vulnerable
Ubuntumosquittopro1.6.9-1ubuntu0.1~esm1fixed
Ubuntumosquittopro1.6.6-1vulnerable
Ubuntumosquittopro1.6.7-1vulnerable
Ubuntumosquittopro1.6.8-1vulnerable
Ubuntumosquittopro1.6.8-2vulnerable
Ubuntumosquittopro1.6.9-1~build1vulnerable
Ubuntumosquittopro1.6.9-1vulnerable
Ubuntumosquittopro1.6.9-1ubuntu0.1~esm1fixed
Ubuntumosquitto22.042.0.11-1vulnerable
Ubuntumosquitto22.042.0.11-1build1vulnerable
Ubuntumosquitto22.042.0.11-1ubuntu1vulnerable
Ubuntumosquitto22.042.0.11-1ubuntu1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianmosquittosourcesid2.0.11-1not yet assignedNot reportedNot reported
Debianmosquittosourceforky2.0.11-1not yet assignedNot reportedNot reported
Debianmosquittosourcetrixie2.0.11-1not yet assignedNot reportedNot reported
Debianmosquittosourcebookworm2.0.11-1not yet assignedNot reportedNot reported
Ubuntumosquittodebpro1.6.9-1ubuntu0.1~esm1Not reportedUBUNTU-CVE-2021-34431Not reported
Ubuntumosquittodebpro1.6.9-1ubuntu0.1~esm1Not reportedUSN-6492-1Not reported
Ubuntumosquittodeb22.042.0.11-1ubuntu1.1Not reportedUSN-6492-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libmosquitto1]Fixed

    Source package: [mosquitto]

    Details (6)

    • 2.0.11-1.2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.21-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.21-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

  • [libmosquitto-dev]Fixed

    Source package: [mosquitto]

    Details (6)

    • 2.0.11-1.2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.21-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.21-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

  • [libmosquittopp1]Fixed

    Source package: [mosquitto]

    Details (6)

    • 2.0.11-1.2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.21-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.21-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

  • [libmosquittopp-dev]Fixed

    Source package: [mosquitto]

    Details (6)

    • 2.0.11-1.2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.21-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.21-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

  • [mosquitto]Fixed
    Details (6)

    • 2.0.11-1.2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.21-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.21-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

  • [mosquitto-clients]Fixed

    Source package: [mosquitto]

    Details (6)

    • 2.0.11-1.2+deb12u2 · amd64 · bookworm

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u2 · arm64 · bookworm

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.21-1~bpo12+1 · amd64 · bookworm-backports

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.21-1~bpo12+1 · arm64 · bookworm-backports

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

  • [mosquitto-dev]Fixed

    Source package: [mosquitto]

    Details (6)

    • 2.0.11-1.2+deb12u2 · all · bookworm

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u2 · all · bookworm

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.21-1~bpo12+1 · all · bookworm-backports

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.21-1~bpo12+1 · all · bookworm-backports

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

    • 2.0.11-1.2+deb12u1 · all · bookworm-security

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · bookworm; dsa · mosquitto · debian · 12

[Debian 13 (Trixie)]

  • [libmosquitto1]Fixed

    Source package: [mosquitto]

    Details (2)

    • 2.0.21-1 · amd64 · trixie

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · 13

    • 2.0.21-1 · arm64 · trixie

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · 13

  • [libmosquitto-dev]Fixed

    Source package: [mosquitto]

    Details (2)

    • 2.0.21-1 · amd64 · trixie

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · 13

    • 2.0.21-1 · arm64 · trixie

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · 13

  • [libmosquittopp1]Fixed

    Source package: [mosquitto]

    Details (2)

    • 2.0.21-1 · amd64 · trixie

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · 13

    • 2.0.21-1 · arm64 · trixie

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · 13

  • [libmosquittopp-dev]Fixed

    Source package: [mosquitto]

    Details (2)

    • 2.0.21-1 · amd64 · trixie

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · 13

    • 2.0.21-1 · arm64 · trixie

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · 13

  • [mosquitto]Fixed
    Details (2)

    • 2.0.21-1 · amd64 · trixie

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · 13

    • 2.0.21-1 · arm64 · trixie

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · 13

  • [mosquitto-clients]Fixed

    Source package: [mosquitto]

    Details (2)

    • 2.0.21-1 · amd64 · trixie

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · 13

    • 2.0.21-1 · arm64 · trixie

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · 13

  • [mosquitto-dev]Fixed

    Source package: [mosquitto]

    Details (2)

    • 2.0.21-1 · all · trixie

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · 13

    • 2.0.21-1 · all · trixie

      Fixed · Fixed: 2.0.11-1

      dsa · mosquitto · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]