Description

In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on_subscribe callback. This affects the mosquitto_sub and mosquitto_rr clients.

INFO

Published Date :

2024-10-30T11:41:08.946Z

Last Modified :

2025-11-03T20:36:24.107Z

Source :

eclipse
AFFECTED PRODUCTS

The following products are affected by CVE-2024-10525 vulnerability.

Vendors Products
Eclipse
  • Mosquitto
Eclipse Foundation
  • Mosquitto
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-10525.

URL Resource
https://github.com/eclipse-mosquitto/mosquitto/commit/8ab20b4ba4204fdcdec78cb4d9f03c944a6e0e1c cve-icon cve-icon
https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/190 cve-icon cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2025/02/msg00022.html cve-icon
https://mosquitto.org/blog/2024/10/version-2-0-19-released/ cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2024-10525 cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-10525 cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact