CVE-2024-8376 Memory leak

What is CVE-2024-8376?

CVE-2024-8376 is a high-severity use after free vulnerability in Eclipse Foundation Mosquitto, published on 11 Oct 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In Eclipse Mosquitto up to version 2.0.18a, an attacker can achieve memory leaking, segmentation fault or heap-use-after-free by sending specific sequences of "CONNECT", "DISCONNECT", "SUBSCRIBE", "UNSUBSCRIBE" and "PUBLISH" packets.

Weakness: CWE-755, CWE-416, CWE-401

Which versions are affected by CVE-2024-8376?

It affects 1 product.

Products include Eclipse Mosquitto.

How do I fix CVE-2024-8376?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2024-8376 being exploited?

There is no known exploitation of CVE-2024-8376 in the wild and no public exploit code.

Other vulnerabilities in Eclipse Foundation Mosquitto

• CVE-2018-12550 Auth bypass in Eclipse Mosquitto High 8.1
• CVE-2018-12551 Auth bypass in Eclipse Mosquitto High 8.1
• CVE-2023-5632 Unconditionally adding an event to the epoll causes excessive CPU consumption High 7.5
• CVE-2023-28366 Denial of service in n/a High 7.5
• CVE-2021-41039 Denial of service in Eclipse Mosquitto High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BELL-CVE-2024-8376, DEBIAN-CVE-2024-8376, GHSA-72qw-2vp3-gvg9, OESA-2024-2415, OESA-2024-2416, OESA-2024-2417 and 3 more.