PT-2024-8325 · Eclipse+5 · Eclipse Mosquitto+5

Qingpeng Du · Published 2024-10-30 · Updated 2026-03-29 · CVE-2024-10525

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eclipse Mosquitto versions 1.3.2 through 2.0.18

Description The issue is related to a buffer overflow in dynamic memory. If a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on subscribe callback. This affects the mosquitto sub and mosquitto rr clients. A remote attacker may exploit this to gain access to confidential information.

Recommendations For Eclipse Mosquitto versions 1.3.2 through 2.0.18, consider updating to a version that contains a fix for this issue to prevent out of bounds memory access. As a temporary workaround, consider restricting the use of the on subscribe callback function in libmosquitto until a patch is available. Avoid using the mosquitto sub and mosquitto rr clients with untrusted brokers until the issue is resolved.

Fix

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

ALT-PU-2025-3746

BDU:2024-09881

CVE-2024-10525

DLA-4059-1

OESA-2024-2343

OESA-2024-2344

OESA-2024-2345

OESA-2024-2346

OPENSUSE-SU-2026:20260-1

USN-7441-1

Affected Products

Alt Linux

Debian

Eclipse Mosquitto

Linuxmint

Red Os

Ubuntu

References · 44

• https://github.com/eclipse-mosquitto/mosquitto/commit/8ab20b4ba4204fdcdec78cb4d9f03c944a6e0e1c · Patch
• https://ubuntu.com/security/CVE-2024-10525 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10525 · Security Note
• https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/190 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2346 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20260-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-ALPINE-320-CVE-2024-10525 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-3935 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-10525 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-10525 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7441-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-ALPINE-318-CVE-2024-10525 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2024-10525 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2344 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-2345 · Vendor Advisory