Open-Source Case Studies
The effectiveness of Fuzzino has been confirmed on two open-source case studies: Eclipse® Mosquitto and NanoMQ. Both are brokers for the MQTT protocol, which is often used in the Internet of Things to exchange messages in domains such as manufacturing, automotive, and agriculture. We have subjected these brokers to fuzzed inputs on their functional MQTT interfaces, i.e., without a dedicated adapter for security testing. Fuzzino generated and sent fuzzed MQTT messages to the brokers. These messages also considered the server state, which allowed Fuzzino to produce more complex interactions than traditional fuzzers. As a result, our solution found multiple zero-day vulnerabilities in both brokers.
Zero-day vulnerabilities identified using Fuzzino
| CVE-ID | CVSs | Product | Vulnerability | URL |
|---|---|---|---|---|
| CVE-2024-8376 | HIGH 7.2 | Mosquitto | Use-After-Free | https://www.cve.org |
| reopened CVE-2023-28366 (incomplete patch) | Mosquitto | Memory Leaks | ||
| CVE-2025-65953 | MEDIUM 6.0 | NanoMQ | Use-After-Free | https://www.cve.org |
| CVE-2025-59946 | HIGH 7.5 | NanoMQ | Use-After-Free | https://www.cve.org |
| CVE-2025-59947 | HIGH 8.5 | NanoMQ | Buffer Overflow | https://www.cve.org |
| CVE-2025-62723 | MEDIUM 4.3 | FlashMQ | Memory Leaks | https://www.cve.org |
In Mosquitto, Fuzzino has uncovered a high-severity vulnerability (CVE-2024-8376) whose effects range from resource exhaustion to invalid memory accesses, and which can crash the entire broker. Most notably, we detected this vulnerability in just a few minutes. In contrast, Google OSS fuzz continuously tested this Mosquitto release for more than a year with several open-source fuzzers without producing this vulnerability.
On NanoMQ, Fuzzino uncovered two zero-day vulnerabilities which produce invalid memory accesses in a couple of minutes each. This is a drastic improvement compared to the hours or days of fuzzing, which are more common in the industry.