CVE-2021-34434: Eclipse Mosquitto

Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days.

In Eclipse Mosquitto versions 2.0 to 2.0.11, when using the dynamic security plugin, if the ability for a client to make subscriptions on a topic is revoked when a durable client is offline, then existing subscriptions for that client are not revoked.

Affected products

• Eclipse Mosquitto: from 2.0.0, up to and including 2.0.11
• Fedoraproject Fedora: version 34 only; version 35 only

Published 2021-08-30. Last modified 2026-06-17.