PT-2021-6515 · Eclipse+3 · Eclipse Mosquitto+3

Kathrin Kleinhammer · Published 2021-07-22 · Updated 2025-03-10 · CVE-2021-34431

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Eclipse Mosquitto versions 1.6 through 2.0.10

Description The issue is related to incorrect handling of a CONNECT packet without will topic, will message when the will flag and will property are present. This can be exploited by a remote attacker to cause a denial of service. Specifically, if an authenticated client that had connected with MQTT v5 sends a crafted CONNECT message to the broker, a memory leak would occur, which could be used to provide a DoS attack against the broker.

Recommendations For Eclipse Mosquitto versions 1.6 through 2.0.10, consider updating to a version that fixes the memory leak issue to prevent potential DoS attacks. As a temporary workaround, restrict access to the MQTT v5 CONNECT message to minimize the risk of exploitation. Avoid using crafted CONNECT messages that could trigger the memory leak until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

ALT-PU-2023-4418

ALT-PU-2024-12359

ALT-PU-2025-3746

BDU:2022-01775

CVE-2021-34431

ROSA-SA-2023-2224

USN-6492-1

Affected Products

Alt Linux

Eclipse Mosquitto

Linuxmint

Ubuntu

References · 19

• https://cve.org/CVERecord?id=CVE-2021-34431 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-34431 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6492-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-0809 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01775 · Security Note
• https://ubuntu.com/security/CVE-2021-34431 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-41039 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-3592 · Vendor Advisory
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=573191 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-34431 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34431 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-34431 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6492-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-34434 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-34431 · Vendor Advisory