CVE-2021-41039
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 1.3%
exploitation probability
1.3%top 32% of all CVEs
observed exploitation
nono source reports it
In short
A bug in Eclipse Mosquitto allows someone connecting as an MQTT v5 client to send a message with many user properties, which causes the server to use excessive CPU and become slow or unresponsive.
Technical detail
An MQTT v5 client can trigger high CPU consumption by connecting with a large number of user-property attributes, leading to performance degradation and potential denial of service. This affects Mosquitto versions 1.6 to 2.0.11 and requires no authentication or special conditions to trigger.
Summary generated and translated by AI from the official description.
In versions 1.6 to 2.0.11 of Eclipse Mosquitto, an MQTT v5 client connecting with a large number of user-property properties could cause excessive CPU usage, leading to a loss of performance and possible denial of service.
Affected products
The Eclipse Foundation · Eclipse Mosquitto