Skip to content
fr Sign in
9.6 Critical

CVE-2024-38373 FreeRTOS-Plus-TCP is a lightweight TCP/IP stack for FreeRTOS

Description

FreeRTOS-Plus-TCP is a lightweight TCP/IP stack for FreeRTOS. FreeRTOS-Plus-TCP versions 4.0.0 through 4.1.0 contain a buffer over-read issue in the DNS Response Parser when parsing domain names in a DNS response. A carefully crafted DNS response with domain name length value greater than the actual domain name length, could cause the parser to read beyond the DNS response buffer. This issue affects applications using DNS functionality of the FreeRTOS-Plus-TCP stack. Applications that do not use DNS functionality are not affected, even when the DNS functionality is enabled. This vulnerability has been patched in version 4.1.1.

Affected products and versions

Product Affected versions Fixed in
FreeRTOS-Plus-TCP 4.0 4.0.0 → 4.1.0 No fix stated
FreeRTOS-Plus-TCP 4.0 4.0.0 → < 4.1.1 4.1.1

References

Timeline

  1. Published
  2. Last modified

Other CVEs of FreeRTOS-Plus-TCP

The 3 CVEs of FreeRTOS-Plus-TCP →
CVE-2026-102552 Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before… 5.9 Medium CVE-2026-102551 Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon… 7.7 High
Track this CVE