Version 2.0.21 of Mosquitto has been released. This is a security and bugfix release.

Security:

Fix leak on malicious SUBSCRIBE by authenticated client. Closes [eclipse #248].
Further fix for CVE-2023-28366.

Broker

Fix clients sending a RESERVED packet not being quickly disconnected. Closes #2325.
Fix bind_interface producing an error when used with an interface that has an IPv6 link-local address and no other IPv6 addresses. Closes #2696.
Fix mismatched wrapped/unwrapped memory alloc/free in properties. Closes #3192.
Fix allow_anonymous false not being applied in local only mode. Closes #3198.
Add retain_expiry_interval option to fix expired retained message not being removed from memory if they are not subscribed to. Closes #3221.
Produce an error if invalid combinations of cafile/capath/certfile/keyfile are used. Closes #1836. Closes #3130.
Backport keepalive checking from develop to fix problems in current implementation. Closes #3138.

Client library

Fix potential deadlock in mosquitto_sub if -W is used. Closes #3175.

Apps

mosquitto_ctrl dynsec now also allows -i to specify a clientid as well as -c. This matches the documentation which states -i. Closes #3219. Client library:
Fix threads linking on Windows for static libmosquitto library Closes #3143

Build

Fix Windows builds not having websockets enabled.
Add tzdata to docker images

Tests

Fix 08-ssl-connect-cert-auth-expired and 08-ssl-connect-cert-auth-revoked tests when under load. Closes #3208.