Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-34446

Date: May 2, 2024

Mullvad VPN through 2024.1 on Android does not set a DNS server in the blocking state (after a hard failure to create a tunnel), and thus DNS traffic can leave the device. Data showing that the affected device was the origin of sensitive DNS requests may be observed and logged by operators of unintended DNS servers.

Language: RUST

Severity Score

Related Resources (7)

https://mullvad.net/en/blog/dns-traffic-can-leak-outside-the-vpn-tunnel-on-android
https://github.com/mullvad/mullvadvpn-app/blob/main/CHANGELOG.md
https://github.com/mullvad/mullvadvpn-app/tags
https://github.com/mullvad/mullvadvpn-app/commit/0c39306a40f426853d617e20d596942e41091f13
https://nvd.nist.gov/vuln/detail/CVE-2024-34446
https://news.ycombinator.com/item?id=40247604
https://www.mend.io/vulnerability-database/CVE-2024-34446

Severity Score

Weakness Type (CWE)

Improper Restriction of Communication Channel to Intended Endpoints

CWE-923

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): NONE

Do you need more information?

Contact Us