CVE-2024-8376

What it actually does

Sending crafted sequences of CONNECT, DISCONNECT, SUBSCRIBE, UNSUBSCRIBE and PUBLISH packets triggers memory leaks, segmentation faults or heap-use-after-free conditions in the broker's packet handling logic.

Why it matters to the business

MQTT brokers can crash or leak memory under attacker-controlled traffic, causing service outages for IoT and messaging systems that rely on the broker for device communication and data routing.

How an attack unfolds

An attacker connects to an exposed Mosquitto instance and transmits a precise series of MQTT control packets that exercise the vulnerable state machine, resulting in invalid memory access or resource exhaustion.

How to fix it

Upgrade eclipse-mosquitto/mosquitto to the commit 1914b3ee2a18102d0a94cbdbbfeae1afa03edd17 or later release that resolves the packet sequence handling flaw.

How to confirm the fix worked

Confirm the broker reports the fixed commit hash on startup or via version query; replay the known packet sequences in a test environment to verify absence of crashes or leaks.

Typical attack path

1. Establish TCP connection to the broker
2. Send crafted CONNECT packet
3. Follow with specific DISCONNECT, SUBSCRIBE, UNSUBSCRIBE and PUBLISH combinations
4. Trigger use-after-free or crash condition

How to detect it

Review broker logs for repeated abnormal packet sequences or sudden process terminations; inspect core dumps or memory profiles for signs of heap corruption after unexpected disconnects.

What your security team should do

• Apply the fixed commit or newer release immediately on all public-facing brokers
• Restrict inbound MQTT access to trusted networks until patched
• Monitor for unusual packet rates or connection patterns from untrusted sources