CVE-2024-36856

RMQTT Broker 0.4.0 is vulnerable to Denial of Service (DoS) due to improper session resource management. An attacker can exhaust system memory and crash the daemon by establishing and maintaining a vast number of long-lived malicious publish/subscribe sessions.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://gist.github.com/pengwGit/d8410afeb0d5d11ab79f596a32178c2e
https://github.com/rmqtt/rmqtt/releases/tag/0.4.0
https://gist.github.com/pengwGit/d8410afeb0d5d11ab79f596a32178c2e
https://github.com/rmqtt/rmqtt/releases/tag/0.4.0

Configurations

No configuration.

History

No history.

Information

Published : 2024-06-12 03:15

Updated : 2026-06-17 07:37

NVD link : CVE-2024-36856

Mitre link : CVE-2024-36856

CVE.ORG link : CVE-2024-36856

JSON object : View

Products Affected

No product.

CWE

CWE-404

Improper Resource Shutdown or Release

{"id": "CVE-2024-36856", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-36856", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-22T18:08:12.484880Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "affectedData": [{"cpes": ["cpe:2.3:a:rmqtt:rmqtt:*:*:*:*:*:*:*:*"], "vendor": "rmqtt", "product": "rmqtt", "versions": [{"status": "affected", "version": "0.4.0"}], "defaultStatus": "unknown"}]}], "published": "2024-06-12T03:15:39.477", "references": [{"url": "https://gist.github.com/pengwGit/d8410afeb0d5d11ab79f596a32178c2e", "source": "cve@mitre.org"}, {"url": "https://github.com/rmqtt/rmqtt/releases/tag/0.4.0", "source": "cve@mitre.org"}, {"url": "https://gist.github.com/pengwGit/d8410afeb0d5d11ab79f596a32178c2e", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/rmqtt/rmqtt/releases/tag/0.4.0", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-404"}]}], "descriptions": [{"lang": "en", "value": "RMQTT Broker 0.4.0 is vulnerable to Denial of Service (DoS) due to improper session resource management. An attacker can exhaust system memory and crash the daemon by establishing and maintaining a vast number of long-lived malicious publish/subscribe sessions."}, {"lang": "es", "value": "RMQTT Broker 0.4.0 permite a atacantes remotos provocar una denegaci\u00f3n de servicio (ca\u00edda del daemon) a trav\u00e9s de una determinada secuencia de cinco paquetes TCP. "}], "lastModified": "2026-06-17T07:37:15.087", "sourceIdentifier": "cve@mitre.org"}