description: In Eclipse Mosquitto version 1.6 to 2.0.10, if an authenticated client that had connected with MQTT v5 sent a crafted CONNECT message to the broker a memory leak would occur, which could be used to provide a DoS attack against the broker.
problem types: CWE-401: Missing Release of Memory after Effective Lifetime
affected:
{
product: Eclipse Mosquitto
vendor: The Eclipse Foundation
versions:
lessThan: unspecified, status: affected, version: 1.6, versionType: custom
lessThanOrEqual: 2.0.10, status: affected, version: unspecified, versionType: custom
}