CVE-2024-34446: High severity Mullvad Mullvad VPN vulnerability
Mullvad VPN through 2024.1 on Android does not set a DNS server in the blocking state (after a hard failure to create a tunnel), and thus DNS traffic can leave the device. Data showing that the affected device was the origin of sensitive DNS requests may be observed and logged by operators of unintended DNS servers.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-34446?
CVE-2024-34446 is classified as a high-severity vulnerability due to the potential leak of sensitive DNS traffic.
How do I fix CVE-2024-34446?
To fix CVE-2024-34446, update Mullvad VPN to version 2024.2 or later that addresses the DNS configuration issue.
What happens if I do not address CVE-2024-34446?
Failing to address CVE-2024-34446 may expose your device to DNS leaks, allowing sensitive information to be logged by external operators.
Which versions of Mullvad VPN are affected by CVE-2024-34446?
Mullvad VPN versions up to and including 2024.1 are affected by CVE-2024-34446.
What specific issue does CVE-2024-34446 cause in Mullvad VPN?
CVE-2024-34446 causes Mullvad VPN to not set a DNS server in a blocking state after a tunnel creation failure, leading to potential DNS traffic leak.