CVE-2021-28166 Null dereference in Eclipse Mosquitto

What is CVE-2021-28166?

CVE-2021-28166 is a medium-severity vulnerability in The Eclipse Foundation Eclipse Mosquitto, published on 7 Apr 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In Eclipse Mosquitto version 2.0.0 to 2.0.9, if an authenticated client that had connected with MQTT v5 sent a crafted CONNACK message to the broker, a NULL pointer dereference would occur.

Weakness: CWE-476

Which versions are affected by CVE-2021-28166?

It affects 1 product.

Products include Eclipse Mosquitto.

How do I fix CVE-2021-28166?

Upgrade to a fixed version.

Is CVE-2021-28166 being exploited?

There is no known exploitation of CVE-2021-28166 in the wild and no public exploit code.

Other vulnerabilities in The Eclipse Foundation Eclipse Mosquitto

• CVE-2018-12550 Auth bypass in Eclipse Mosquitto High 8.1
• CVE-2018-12551 Auth bypass in Eclipse Mosquitto High 8.1
• CVE-2023-5632 Unconditionally adding an event to the epoll causes excessive CPU consumption High 7.5
• CVE-2023-28366 Denial of service in n/a High 7.5
• CVE-2021-41039 Denial of service in Eclipse Mosquitto High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2021-28166, DEBIAN-CVE-2021-28166, GHSA-3647-h3m7-326w.