Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-34446: Mullvad VPN through 2024.1 on Android does not set a DNS server in the blocking state (after a hard failure to create a tunnel), and thus DNS traffic can leave the device. Data showing that the aff...

CVE-2024-34446 · published 2 years ago

Summary

Mullvad VPN through 2024.1 on Android does not set a DNS server in the blocking state (after a hard failure to create a tunnel), and thus DNS traffic can leave the device. Data showing that the affected device was the origin of sensitive DNS requests may be observed and logged by operators of uninte...

Original advisory text

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34446... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-34446 Vendor Advisory
https://github.com/mullvad/mullvadvpn-app/blob/main/CHANGELOG.md URL
https://github.com/mullvad/mullvadvpn-app/tags URL
https://news.ycombinator.com/item?id=40247604 URL
https://github.com/mullvad/mullvadvpn-app/commit/0c39306a40f426853d617e20d596942... Patch
https://mullvad.net/en/blog/dns-traffic-can-leak-outside-the-vpn-tunnel-on-andro... Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.5 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-923Improper Restriction of Communication Channel to Intended Endpoints

Timeline

Published3 May 2024

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2024-34446 · NVD

CVE-2024-34446 · OSV

Track software like this

Free during beta