CVE-2021-28166
In Eclipse Mosquitto version 2.0.0 to 2.0.9, if an authenticated client that had connected with...
In Eclipse Mosquitto version 2.0.0 to 2.0.9, if an authenticated client that had connected with MQTT v5 sent a crafted CONNACK message to the broker, a NULL pointer dereference would occur.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
In Eclipse Mosquitto version 2.0.0 to 2.0.9, if an authenticated client that had connected with MQTT v5 sent a crafted CONNACK message to the broker, a NULL pointer dereference would occur.
- Record
CVE-2021-28166- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C - Weakness
- CWE-476
- Updated
- 2026-11-02
EUVDEUVD-2021-14859
In Eclipse Mosquitto version 2.0.0 to 2.0.9, if an authenticated client that had connected with MQTT v5 sent a crafted CONNACK message to the broker, a NULL pointer dereference would occur.
- Record
EUVD-2021-14859- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3647-h3m7-326w No score
In Eclipse Mosquitto version 2.0.0 to 2.0.9, if an authenticated client that had connected with...
In Eclipse Mosquitto version 2.0.0 to 2.0.9, if an authenticated client that had connected with MQTT v5 sent a crafted CONNACK message to the broker, a NULL pointer dereference would occur.
- Record
GHSA-3647-h3m7-326w- Weakness
- CWE-476
- Updated
- 2026-11-02
NVD
In Eclipse Mosquitto version 2.0.0 to 2.0.9, if an authenticated client that had connected with MQTT v5 sent a crafted CONNACK message to the broker, a NULL pointer dereference would occur.
- Record
CVE-2021-28166- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:N/A:P - Weakness
- CWE-476
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-28166
In Eclipse Mosquitto version 2.0.0 to 2.0.9, if an authenticated client that had connected with MQTT v5 sent a crafted CONNACK message to the broker, a NULL pointer dereference would occur.
- Record
ALPINE-CVE-2021-28166- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBELL-CVE-2021-28166
CVE-2021-28166 does not affect BellSoft software
- Record
BELL-CVE-2021-28166- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSV
In Eclipse Mosquitto version 2.0.0 to 2.0.9, if an authenticated client that had connected with MQTT v5 sent a crafted CONNACK message to the broker, a NULL pointer dereference would occur.
- Record
CVE-2021-28166- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-28166
In Eclipse Mosquitto version 2.0.0 to 2.0.9, if an authenticated client that had connected with MQTT v5 sent a crafted CONNACK message to the broker, a NULL pointer dereference would occur.
- Record
DEBIAN-CVE-2021-28166- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-28166
In Eclipse Mosquitto version 2.0.0 to 2.0.9, if an authenticated client that had connected with MQTT v5 sent a crafted CONNACK message to the broker, a NULL pointer dereference would occur.
- Record
UBUNTU-CVE-2021-28166- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11057-1 No score
libmosquitto1-2.0.11-1.2 on GA media
These are all security issues fixed in the libmosquitto1-2.0.11-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11057-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mosquittoAlpine:v3.14 |
2.0.0 up to 2.0.10-r0 | 2.0.10-r0 |
mosquittoAlpine:v3.15 |
2.0.0 up to 2.0.10-r0 | 2.0.10-r0 |
mosquittoAlpine:v3.16 |
2.0.0 up to 2.0.10-r0 | 2.0.10-r0 |
mosquittoAlpine:v3.17 |
2.0.0 up to 2.0.10-r0 | 2.0.10-r0 |
mosquittoAlpine:v3.18 |
2.0.0 up to 2.0.10-r0 | 2.0.10-r0 |
mosquittoAlpine:v3.19 |
2.0.0 up to 2.0.10-r0 | 2.0.10-r0 |
mosquittoAlpine:v3.20 |
2.0.0 up to 2.0.10-r0 | 2.0.10-r0 |
mosquittoAlpine:v3.21 |
2.0.0 up to 2.0.10-r0 | 2.0.10-r0 |
mosquittoAlpine:v3.22 |
2.0.0 up to 2.0.10-r0 | 2.0.10-r0 |
mosquittoAlpine:v3.23 |
2.0.0 up to 2.0.10-r0 | 2.0.10-r0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-28166 is a medium vulnerability (CVSS 6.5) in Eclipse Mosquitto, published April 7, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.97%, the 62nd percentile. Fixed in mosquitto 2.0.10-r0.
References
bugs.eclipse.org/bugs/show_bug.cgi?id=572608
nvd.nist.gov/vuln/detail/CVE-2021-28166
github.com/advisories/GHSA-3647-h3m7-326w
security.alpinelinux.org/vuln/CVE-2021-28166
docs.bell-sw.com/security/cves/CVE-2021-28166
security-tracker.debian.org/tracker/CVE-2021-28166
Show 14 moreShow less
ubuntu.com/security/CVE-2021-28166
cve.org/CVERecord?id=CVE-2021-28166
suse.com/security/cve/CVE-2017-7650