The mosquitto update to versions 2.0.21, 2.0.22, and 2.0.23 fixes several issues that could cause crashes or improper behavior. Key fixes include improved handling of disconnected sessions when per_listener_settings is true, validation of OpenSSL function return values to prevent crashes, and protection against crashes caused by malicious or corrupt persistence files from older versions. Other fixes address bridge idle timeouts, client disconnection misreporting, TLS error handling, and systemd service startup synchronization. These updates improve stability and robustness but do not describe specific exploitation techniques or vulnerabilities with known exploits.

The impact involves potential crashes and instability in the mosquitto broker and client library under certain conditions, such as malformed persistence files, incorrect OpenSSL certificate handling, and specific bridge or client configurations. These issues could disrupt MQTT service availability but no active exploitation or data compromise is indicated in the provided information.

A security update is available that addresses these issues in mosquitto versions 2.0.21 through 2.0.23. Users should upgrade to at least version 2.0.23 to benefit from these fixes. No additional mitigation actions are specified or required beyond applying the update.