CVE-2021-28166: Eclipse Mosquitto

Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days.

In Eclipse Mosquitto version 2.0.0 to 2.0.9, if an authenticated client that had connected with MQTT v5 sent a crafted CONNACK message to the broker, a NULL pointer dereference would occur.

Affected products

• Eclipse Mosquitto: from 2.0.0, up to and including 2.0.9

Published 2021-04-07. Last modified 2026-06-17.