Versions 2.0.11 and 1.6.15 of Mosquitto has been released. These are a security and bugfix releases.

2.0.11

Security

If an authenticated client connected with MQTT v5 sent a crafted CONNECT message to the broker a memory leak would occur. Affects versions 1.6 to 2.0.10 inclusive.

Broker

Fix possible crash having just upgraded from 1.6 if per_listener_settings true is set, and a SIGHUP is sent to the broker before a client has reconnected to the broker. Closes #2167.
Fix bridge not reconnectng if the first reconnection attempt fails. Closes #2207.
Improve QoS 0 outgoing packet queueing.
Fix non-reachable bridge blocking the broker on Windows. Closes #2172.
Fix possible corruption of pollfd array on Windows when bridges were reconnecting. Closes #2173.
Fix QoS 0 messages not being queued when queue_qos0_messages was enabled. Closes #2224.

Clients

If sending mosquitto_sub output to a pipe, mosquitto_sub will now detect that the pipe has closed and disconnect. Closes #2164.
Fix mosquitto_pub -l quitting if a message publication is attempted when the broker is temporarily unavailable. Closes #2187.

1.6.15

Security

If an authenticated client connected with MQTT v5 sent a crafted CONNECT message to the broker a memory leak would occur. Affects versions 1.6 to 2.0.10 inclusive.