In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on_subscribe callback. This affects the mosquitto_sub and mosquitto_rr clients.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20260-1 advisory.

    Changes in mosquitto:

    - update to 2.0.23 (boo#1258671)
      * Fix handling of disconnected sessions for `per_listener_settings         true`
      * Check return values of openssl *_get_ex_data() and
        *_set_ex_data() to prevent possible crash. This could occur only         in extremely unlikely situations
      * Check return value of openssl ASN1_string_[get0_]data()         functions for NULL. This prevents a crash in case of incorrect         certificate handling in openssl
      * Fix potential crash on startup if a malicious/corrupt         persistence file from mosquitto 1.5 or earlier is loaded
      * Limit auto_id_prefix to 50 characters

    - Update to version 2.0.22       Broker
      * Bridge: Fix idle_timeout never occurring for lazy bridges.
      * Fix case where max_queued_messages = 0 was not treated as         unlimited.
      * Fix --version exit code and output.
      * Fix crash on receiving a $CONTROL message over a bridge, if         per_listener_settings is set true and the bridge is carrying         out topic remapping.
      * Fix incorrect reference clock being selected on startup on         Linux. Closes #3238.
      * Fix reporting of client disconnections being incorrectly         attributed to out of memory.
      * Fix compilation when using WITH_OLD_KEEPALIVE.
      * Fix problems with secure websockets.
      * Fix crash on exit when using WITH_EPOLL=no.
      * Fix clients being incorrectly expired when they have         keepalive == max_keepalive. Closes #3226, #3286.
      Dynamic security plugin
      * Fix mismatch memory free when saving config which caused         memory tracking to be incorrect.
      Client library
      * Fix C++ symbols being removed when compiled with link time         optimisation.
      * TLS error handling was incorrectly setting a protocol error         for non-TLS errors. This would cause the mosquitto_loop_start()         thread to exit if no broker was available on the first         connection attempt. This has been fixed. Closes #3258.
      * Fix linker errors on some architectures using cmake.

    - Update to version 2.0.21       Broker
      * Fix clients sending a RESERVED packet not being quickly         disconnected.
      * Fix bind_interface producing an error when used with an         interface that has an IPv6 link-local address and no other         IPv6 addresses.
      * Fix mismatched wrapped/unwrapped memory alloc/free in         properties.
      * Fix allow_anonymous false not being applied in local only mode.
      * Add retain_expiry_interval option to fix expired retained         message not being removed from memory if they are not         subscribed to.
      * Produce an error if invalid combinations of         cafile/capath/certfile/keyfile are used.
      * Backport keepalive checking from develop to fix problems in         current implementation.
      Client library
      * Fix potential deadlock in mosquitto_sub if -W is used.
      Apps
      * mosquitto_ctrl dynsec now also allows -i to specify a clientid         as well as -c. This matches the documentation which states -i.
      Tests
      * Fix 08-ssl-connect-cert-auth-expired and         08-ssl-connect-cert-auth-revoked tests when under load.

    - systemd service: Wait till the network got setup to avoid       startup failure.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0990 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2024-10525:
    In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK     packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting     in its on_subscribe callback. This affects the mosquitto_sub and mosquitto_rr clients.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7441-1 advisory.

    It was discovered that Eclipse Mosquitto client incorrectly handled memory when receiving a SUBACK packet.
    An attacker with a malicious broker could possibly use this issue to execute arbitrary code or cause a     denial of service. (CVE-2024-10525)

    Xiangpu Song discovered that Eclipse Mosquitto broker did not properly manage memory under certain     circumstances. A malicious client with a remote connection could possibly use this issue to cause the     broker to crash resulting in a denial of service, or another unspecified impact. This issue only affected     Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-3935)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4059 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4059-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Abhijith PA     February 20, 2025                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : mosquitto     Version        : 2.0.11-1+deb11u2     CVE ID         : CVE-2024-3935 CVE-2024-10525


    The following vulnerabilities have been discovered in the package     mosquitto, MQTT message broker.

    CVE-2024-3935

        If a Mosquitto broker is configured to create an outgoing bridge         connection, and that bridge connection has an incoming topic         configured that makes use of topic remapping, then if the remote         connection sends a crafted PUBLISH packet to the broker a double         free will occur with a subsequent crash of the broker.


    CVE-2024-10525

        If a malicious broker sends a crafted SUBACK packet with no reason         codes, a client using libmosquitto may make out of bounds memory         access when acting in its on_subscribe callback. This affects the         mosquitto_sub and mosquitto_rr clients.


    For Debian 11 bullseye, these problems have been fixed in version     2.0.11-1+deb11u2.

    We recommend that you upgrade your mosquitto packages.

    For the detailed security status of mosquitto please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/mosquitto

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
299946	openSUSE 16 Security Update : mosquitto (openSUSE-SU-2026:20260-1)	Nessus	SuSE Local Security Checks	high
239122	TencentOS Server 4: mosquitto (TSSA-2024:0990)	Nessus	Tencent Local Security Checks	high
234681	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Eclipse Mosquitto vulnerabilities (USN-7441-1)	Nessus	Ubuntu Local Security Checks	high
216526	Debian dla-4059 : libmosquitto-dev - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2024-10525

high

Tenable Plugins

high

high

high

high