CVE-2024-42644

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-42644
FlashMQ v1.14.0 was discovered to contain an assertion failure in the function PublishCopyFactory::getNewPublish, which occurs when the QoS value of the publish object is greater than 0.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/halfgaar/FlashMQ Product
https://github.com/songxpu/bug_report/blob/master/MQTT/FlashMQ/cve-2024-42644.md Exploit Third Party Advisory
https://www.flashmq.org/2024/06/17/flashmq-1-15-1-released/ Release Notes
https://github.com/songxpu/bug_report/blob/master/MQTT/FlashMQ/cve-2024-42644.md Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:flashmq:flashmq:1.14.0:*:*:*:*:*:*:*
History

06 Aug 2025, 20:48

Type Values Removed Values Added
CPE cpe:2.3:a:flashmq:flashmq:1.14.0:*:*:*:*:*:*:*
First Time Flashmq
Flashmq flashmq
References () https://github.com/halfgaar/FlashMQ - () https://github.com/halfgaar/FlashMQ - Product
References () https://github.com/songxpu/bug_report/blob/master/MQTT/FlashMQ/cve-2024-42644.md - () https://github.com/songxpu/bug_report/blob/master/MQTT/FlashMQ/cve-2024-42644.md - Exploit, Third Party Advisory
References () https://www.flashmq.org/2024/06/17/flashmq-1-15-1-released/ - () https://www.flashmq.org/2024/06/17/flashmq-1-15-1-released/ - Release Notes

30 Jul 2025, 16:15

Type Values Removed Values Added
References () https://github.com/songxpu/bug_report/blob/master/MQTT/FlashMQ/cve-2024-42644.md - () https://github.com/songxpu/bug_report/blob/master/MQTT/FlashMQ/cve-2024-42644.md -
Summary
  • (es) Se descubrió que FlashMQ v1.14.0 contiene una falla de afirmación en la función PublishCopyFactory::getNewPublish, que ocurre cuando el valor de QoS del objeto de publicación es mayor que 0.
CWE CWE-617
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

29 Jul 2025, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-29 14:15

Updated : 2025-08-06 20:48

NVD link : CVE-2024-42644

Mitre link : CVE-2024-42644

CVE.ORG link : CVE-2024-42644

JSON object : View

Products Affected

flashmq

  • flashmq
CWE
CWE-617

Reachable Assertion