VULNERABILITY INTELLIGENCE

CVE-2021-28166

CVSS score6.5 MEDIUM

EPSS probability0.97%

CISA KEVNot currently listed

Published2021-04-07

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Description

In Eclipse Mosquitto version 2.0.0 to 2.0.9, if an authenticated client that had connected with MQTT v5 sent a crafted CONNACK message to the broker, a NULL pointer dereference would occur.

Weakness classification

emo@eclipse.org: CWE-476
nvd@nist.gov: CWE-476

Primary references

emo@eclipse.org — Issue Tracking, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch, Vendor Advisory