Register for the AI for Security Summit: Join Figma, Perplexity & Wiz

CVE-2021-34432
NixOS vulnerability analysis and mitigation

Overview

CVE-2021-34432 affects Eclipse Mosquitto versions 2.0.0 through 2.0.7. The vulnerability was discovered on June 10, 2021, and involves a server crash condition when a client sends a PUBLISH packet with a topic length of 0. This security issue specifically impacts the MQTT broker functionality in Eclipse Mosquitto (Eclipse Bug).

Technical details

The vulnerability occurs when a client attempts to send a PUBLISH packet with a topic length set to 0, which causes the Mosquitto server to crash. The issue has a CVSS 3.1 base score of 7.5 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability can be triggered remotely and requires no special privileges or user interaction (Ubuntu CVE).

Impact

When exploited, this vulnerability results in a denial of service condition by causing the Mosquitto server to crash. The impact is limited to availability, with no direct effect on confidentiality or integrity of the system (Rapid7).

Exploitability

The vulnerability can be exploited remotely by sending a specially crafted MQTT packet to the server. A proof of concept exists that demonstrates the exploit using a simple network command (Eclipse Bug).

Mitigation and workarounds

The vulnerability was fixed in Eclipse Mosquitto version 2.0.8 through a patch that addresses the topic length validation. The fix was implemented in commit 9b08faf0bdaf5a4f2e6e3dd1ea7e8c57f70418d6. Users are advised to upgrade to version 2.0.8 or later to mitigate this vulnerability (Debian Security).

Additional resources

Linux Distribution fix status

Fix availability across major Linux distributions and their releases.

Alpine

Fixed

edge

mosquitto: 2.0.8-r0

Fixed

v3.18

mosquitto: 2.0.8-r0

Fixed

v3.19

mosquitto: 2.0.8-r0

Fixed

v3.20

mosquitto: 2.0.8-r0

Fixed

v3.21

mosquitto: 2.0.8-r0

Fixed

v3.22

mosquitto: 2.0.8-r0

Fixed

v3.23

mosquitto: 2.0.8-r0

Fixed

SourceThis report was generated using AI

Related NixOS vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2026-91782LOW1.9
  • NixOS logoNixOS
  • gcc10-binutils
NoYesSep 15, 2026
CVE-2026-91781LOW1.9
  • NixOS logoNixOS
  • binutils
NoYesSep 15, 2026
CVE-2026-91780LOW1.9
  • NixOS logoNixOS
  • binutils
NoNoSep 15, 2026
CVE-2026-91779LOW1.9
  • NixOS logoNixOS
  • binutils
NoNoSep 15, 2026
CVE-2026-90831LOW1.9
  • NixOS logoNixOS
  • gcc-toolset-16-binutils.src
NoYesSep 14, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management