In Mosquitto before 2.0.16, excessive memory is allocated based on malicious initial packets that are not CONNECT packets.