Critical severity9.8NVD Advisory· Published Oct 30, 2024· Updated Jun 17, 2026

CVE-2024-10525

Description

In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on_subscribe callback. This affects the mosquitto_sub and mosquitto_rr clients.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Eclipse/Mosquitto2 versions
cpe:2.3:a:eclipse:mosquitto:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:eclipse:mosquitto:*:*:*:*:*:*:*:*range: >=1.3.2,<2.0.19
- (no CPE)range: 1.3.2 - 2.0.18
osv-coords
pkg:rpm/opensuse/mosquitto&distro=openSUSE%20Leap%2016.0
Range: < 2.0.23-bp160.1.1
Eclipse Foundation/mosquittov5
Range: 1.3.2

Patches

Vulnerability mechanics

References

github.com/eclipse-mosquitto/mosquitto/commit/8ab20b4ba4204fdcdec78cb4d9f03c944a6e0e1cnvdPatch
gitlab.eclipse.org/security/vulnerability-reports/-/issues/190nvdExploitIssue TrackingVendor Advisory
mosquitto.org/blog/2024/10/version-2-0-19-released/nvdRelease Notes
lists.debian.org/debian-lts-announce/2025/02/msg00022.htmlnvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.047
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000