PT-2024-38981 · Eclipse+3 · Eclipse Mosquitto+3

Martin Schneider + 3 · Published 2024-10-11 · Updated 2026-03-29 · CVE-2024-8376

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Eclipse Mosquitto versions up to 2.0.18a

Description: The issue allows an attacker to cause memory leaking, segmentation fault, or heap-use-after-free by sending specific sequences of packets, including "CONNECT", "DISCONNECT", "SUBSCRIBE", "UNSUBSCRIBE", and "PUBLISH" packets.

Recommendations: For Eclipse Mosquitto versions up to 2.0.18a, consider restricting the handling of "CONNECT", "DISCONNECT", "SUBSCRIBE", "UNSUBSCRIBE", and "PUBLISH" packets until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Leak

Improper Handling of Exceptional Conditions

Use After Free

Weakness Enumeration

CWE-401

CWE-755

CWE-416

Related Identifiers

ALT-PU-2025-1041

ALT-PU-2025-3746

CVE-2024-8376

OESA-2024-2415

OESA-2024-2416

OESA-2024-2417

OESA-2024-2418

RHSA-2024:8718

RHSA-2024:8719

RHSA-2024:8906

Affected Products

Alt Linux

Debian

Eclipse Mosquitto

Red Os

References · 30

• https://github.com/eclipse/mosquitto/releases/tag/v2.0.19 · Patch
• https://github.com/eclipse-mosquitto/mosquitto/commit/1914b3ee2a18102d0a94cbdbbfeae1afa03edd17 · Patch
• https://security-tracker.debian.org/tracker/CVE-2024-8376 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-8376 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-8376 · Security Note
• https://osv.dev/vulnerability/OESA-2024-2415 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-8376 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2416 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-8376 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-8376 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2418 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2024-8376 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-8376 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2417 · Vendor Advisory
• https://gitlab.eclipse.org/security/cve-assignement/-/issues/26 · Vendor Advisory