Every CVE Search/ Get API key

CVE-2021-34432

In Eclipse Mosquitto versions 2.07 and earlier, the server will crash if the client tries to send...

7.5 HighFix available

In Eclipse Mosquitto versions 2.0.7 and earlier, the server will crash if the client tries to send a PUBLISH packet with topic length = 0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.25%Up 0.8 points since Jul 28, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

In Eclipse Mosquitto versions 2.0.7 and earlier, the server will crash if the client tries to send a PUBLISH packet with topic length = 0.

Record
CVE-2021-34432
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

In Eclipse Mosquitto versions 2.0.7 and earlier, the server will crash if the client tries to send a PUBLISH packet with topic length = 0.

Record
CVE-2021-34432
Weakness
CWE-20
Updated
2026-11-02
EUVDEUVD-2021-21088 No score

In Eclipse Mosquitto versions 2.0.7 and earlier, the server will crash if the client tries to send a PUBLISH packet with topic length = 0.

Record
EUVD-2021-21088
Updated
2026-11-02
GitHub AdvisoriesGHSA-9972-xmxv-v66x 7.5

In Eclipse Mosquitto versions 2.07 and earlier, the server will crash if the client tries to send...

In Eclipse Mosquitto versions 2.07 and earlier, the server will crash if the client tries to send a PUBLISH packet with topic length = 0.

Record
GHSA-9972-xmxv-v66x
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
OSVALPINE-CVE-2021-34432 7.5

In Eclipse Mosquitto versions 2.0.7 and earlier, the server will crash if the client tries to send a PUBLISH packet with topic length = 0.

Record
ALPINE-CVE-2021-34432
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBELL-CVE-2021-34432 7.5

CVE-2021-34432 does not affect BellSoft software

Record
BELL-CVE-2021-34432
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 5 moreShow less
OSV 7.5

In Eclipse Mosquitto versions 2.0.7 and earlier, the server will crash if the client tries to send a PUBLISH packet with topic length = 0.

Record
CVE-2021-34432
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-34432 7.5

In Eclipse Mosquitto versions 2.0.7 and earlier, the server will crash if the client tries to send a PUBLISH packet with topic length = 0.

Record
DEBIAN-CVE-2021-34432
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2022-1564 7.5

mosquitto security update

Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power sensors or mobile devices such as phones, embedded computers or micro-controllers like the Arduino.

Security Fix(es):

In Eclipse Mosquitto versions 2.07 and earlier, the server will crash if the client tries to send a PUBLISH packet with topic length = 0.(CVE-2021-34432)

Record
OESA-2022-1564
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2022-2053 7.5

mosquitto security update

Mosquitto is an open source message broker that implements the MQ Telemetry Transport protocol version 3.1 and 3.1.1 MQTT provides a lightweight method of carrying out messaging using a publish/subscribe model. This makes it suitable for "machine to machine" messaging such as with low power sensors or mobile devices such as phones, embedded computers or micro-controllers like the Arduino.

Security Fix(es):

In Eclipse Mosquitto versions 2.07 and earlier, the server will crash if the client tries to send a PUBLISH packet with topic length = 0.(CVE-2021-34432)

Record
OESA-2022-2053
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-34432 7.5

In Eclipse Mosquitto versions 2.07 and earlier, the server will crash if the client tries to send a PUBLISH packet with topic length = 0.

Record
UBUNTU-CVE-2021-34432
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
mosquitto
Alpine:v3.11
 before 1.6.8-r1
1.6.8-r1
mosquitto
Alpine:v3.12
 before 1.6.9-r1
1.6.9-r1
mosquitto
Alpine:v3.13
 before 1.6.12-r3
1.6.12-r3
mosquitto
Alpine:v3.14
 before 2.0.8-r0
2.0.8-r0
mosquitto
Alpine:v3.15
 before 2.0.8-r0
2.0.8-r0
mosquitto
Alpine:v3.16
 before 2.0.8-r0
2.0.8-r0
mosquitto
Alpine:v3.17
 before 2.0.8-r0
2.0.8-r0
mosquitto
Alpine:v3.18
 before 2.0.8-r0
2.0.8-r0
mosquitto
Alpine:v3.19
 before 2.0.8-r0
2.0.8-r0
mosquitto
Alpine:v3.20
 before 2.0.8-r0
2.0.8-r0
Show 11 moreShow less
Affected packages
PackageAffectedFixed
mosquitto
Alpine:v3.21
 before 2.0.8-r0
2.0.8-r0
mosquitto
Alpine:v3.22
 before 2.0.8-r0
2.0.8-r0
mosquitto
Alpine:v3.23
 before 2.0.8-r0
2.0.8-r0
mosquitto
Alpine:v3.24
 before 2.0.8-r0
2.0.8-r0
mosquitto
Debian:12
 before 2.0.8-1
2.0.8-1
mosquitto
Debian:13
 before 2.0.8-1
2.0.8-1
mosquitto
Debian:14
 before 2.0.8-1
2.0.8-1
mosquitto
openEuler:20.03-LTS-SP1
 before 1.6.15-6.oe1
1.6.15-6.oe1
mosquitto
openEuler:20.03-LTS-SP2
 before 1.6.15-6.oe1
1.6.15-6.oe1
mosquitto
openEuler:20.03-LTS-SP3
 before 1.6.15-6.oe1
1.6.15-6.oe1
mosquitto
openEuler:22.03-LTS
 before 1.6.15-6.oe2203
1.6.15-6.oe2203

History

History
RecordedChangedSources
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-34432 is a high vulnerability (CVSS 7.5) in Eclipse Mosquitto, published July 27, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.25%, the 69th percentile. Fixed in mosquitto 1.6.8-r1.

References

Show 5 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open