CVE-2024-10525: Out-of-bounds Write

October 30, 2024 (updated April 8, 2025)

In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on_subscribe callback. This affects the mosquitto_sub and mosquitto_rr clients.

References

gitlab.com/gitlab-org/security-products/gemnasium-db/-/issues/319
nvd.nist.gov/vuln/detail/CVE-2024-10525

Code Behaviors & Features

Detect and mitigate CVE-2024-10525 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →