CVE-2024-51738

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-51738
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-51738.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-51738
Aliases
  • GHSA-3hrw-xv8h-9499
Published
2025-01-20T15:26:03Z
Modified
2026-08-12T15:13:10Z
Severity
  • 7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Sunshine improperly enforces pairing protocol request order
Details

Sunshine is a self-hosted game stream host for Moonlight. In 0.23.1 and earlier, Sunshine's pairing protocol implementation does not validate request order and is thereby vulnerable to a MITM attack, potentially allowing an unauthenticated attacker to pair a client by hijacking a legitimate pairing attempt. This bug may also be used by a remote attacker to crash Sunshine. This vulnerability is fixed in 2025.118.151840.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-305",
        "CWE-476",
        "CWE-841"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51738.json"
}
References

Affected packages

Git / github.com/lizardbyte/sunshine

Affected ranges

Type
GIT
Repo
https://github.com/lizardbyte/sunshine
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
26566cc04db12c5bc7434e480cffa025ed838bce
Fixed
89f097ae65277d42b5d40163d09d92e412e6d7dd
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:lizardbyte:sunshine:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2025.118.151840"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.1.0
v0.1.1
v0.10.0
v0.11.0
v0.11.1
v0.2.0
v0.3.0
v0.3.1
v0.4.0
v0.8.0
v0.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-51738.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "100797209542739115812235067227520091293",
                "329401114149137010212533541894201858521",
                "318869231849667477070365927931170859211",
                "217289876954024892228425605780184212001",
                "209396242423772124008953874661009101364",
                "333404222899660741237501109237317311480",
                "102335417461609269863129701546020173774",
                "252350538578695794295935125722942899083"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-51738-0ba23997",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/lizardbyte/sunshine/commit/26566cc04db12c5bc7434e480cffa025ed838bce",
        "target": {
            "file": "tests/unit/test_http_pairing.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "160844498561842772932513547013655432050",
            "length": 642
        },
        "id": "CVE-2024-51738-12d72a6f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/lizardbyte/sunshine/commit/89f097ae65277d42b5d40163d09d92e412e6d7dd",
        "target": {
            "file": "src/nvhttp.cpp",
            "function": "serverchallengeresp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "152133854009075936021671759599997096250",
                "283638841872078241837862392015622334826",
                "3110693976315495587473557067915681720",
                "20521858407755493836249689550748332712",
                "171598410139176887831346657875462733405",
                "325181674624748110480919520497050182212"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-51738-58e1d206",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/lizardbyte/sunshine/commit/89f097ae65277d42b5d40163d09d92e412e6d7dd",
        "target": {
            "file": "src/nvhttp.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "177637316290372421083051170138073414163",
                "318647337575345959730895921095160178051",
                "102385400524116107304269715160480344042",
                "34702977965122920093242604320575798693",
                "122301692975203061767237739588965364352",
                "246138113582864499747484121623450215575",
                "205555332030114748239224817588368428666",
                "246812980328594123412909437749483744090",
                "66157953685514502215779555737327970307",
                "62588485498797122242583519224974110611",
                "181054466484073672801281205427909663502",
                "179110802001456218046547029766577063266",
                "93688315651898487919948228139437561569",
                "78814872899696576948649143350634162038",
                "305950038604487887802787900489915164369",
                "154187611700140420347083632223123122348",
                "307683959251109501080781789405493246230",
                "234709789558112682171338469085430585721",
                "64500066914564394628753590200037029520",
                "148337318495526781630166616938294716216",
                "281877925081731058265705109200670557376",
                "263983579304344971487606497299026027669",
                "51856049712552465154341756221277062366",
                "319980826222896484009657648763298792617",
                "338643980212166311722126653972208187926",
                "288675966279795303720446917017057897817",
                "103114179253385365051980237587767552304",
                "5481304674359106557246910444042451073",
                "273094409211521065076758546484796812221",
                "109085706054603498588371776564211560708",
                "47386980836366751915335778610597233817",
                "279377080140045126839142743698611273139",
                "290671053946075115574944933653529324805",
                "33871828344283297408616533605113450286",
                "31054038379690131149250867179156398432",
                "282177496811770933157709607383764924884",
                "39494991570148171262501290006862997527",
                "336515193137355085654091726316763014599",
                "299103829848781829455607028454034503791",
                "288126285005199598958904984921628581348",
                "136987813298785459903557174588735990487",
                "39970531531379038424203244505113463046",
                "259018429749801483195648651500490780762",
                "159704393548541010468378553807704416080",
                "326746031938751242893780945605483109625",
                "221159435694731863283531328149941282782",
                "58049021593175703478947477511491859829",
                "293118651125723164481422996715243630024",
                "179440439266901380422511557804348006945",
                "287926690201514577367151817449165564558",
                "97618876142897660399244549302527560130",
                "46544818340439230747932268799032661474",
                "161119136723736213712727099554266418938",
                "121297437550544414210316633645846754109",
                "217939017000037412846516997481259079144",
                "2080701763989565661062235311951207359",
                "216224050467751478420239690982815011371",
                "126629094483625658598407246954195905099",
                "201947432964981357922022122825901746088",
                "313389546990936251266525022103058499272",
                "243264604824205001942497097046223346531",
                "202861624673433224385495409558548658724",
                "28111329536341671598122186532004800793",
                "271266136838805911821000868282462545680",
                "243152427403126883722305744659287436779",
                "227364848059907228665126890458870096823",
                "89270442184099574145393694319777425627",
                "218053157964600911814567393319843770066",
                "44523117640595771422040324550015775631",
                "296212390857067672032655119205604100701",
                "327060918120647617689319256413492824238",
                "327154016150479136158259405798145720302",
                "161073924338990805806364425654447397769",
                "131721747780596960165104310380396947458",
                "144312365711628757255396904932984357414",
                "267552123774586461070637041414174329505",
                "97808554834488080834434960596088612362",
                "317094987318309910635894047396508590522",
                "83798230670534980321287266582409657233",
                "286903009707804448727198876477076669354",
                "72324440677496599261305909033763781091",
                "266241883617578088187302776861376481208",
                "58660332265150423996826594990605699438",
                "283964962628055577436070272652538693390",
                "120804524426805528955603254776957985881",
                "64130668967610877524979389143144067777",
                "158101107975327852276567570326064086418",
                "265256838363221748293537679530765670728",
                "214014613620120707895147270570784750",
                "319522568797659551100244961533740016299",
                "273873108164420199291811217392793720399",
                "332197245400305906265314004282322521142",
                "31852351686135534484195862130624536692",
                "204487138462527251244591351711662235518",
                "83701144778358228479718103857214538215",
                "5442601723982443821996621223020930039",
                "21039961537664253929127883339305029138",
                "239819286939788651300307226968341600717",
                "17261891920437475805404085067537120844",
                "195527562349032225800554038444407503902",
                "55806790172310508737320279476397164529",
                "338383081913350365018805319543790712548",
                "97369092378976240928058042499575014595",
                "39486358478920606350372173589612034545",
                "175591558608044441095535932073697497674",
                "266285447159525203278549460801766956614",
                "184224901771996503212373809267900973734",
                "291391133208753382324558428138567874747",
                "42455795467897399379343972800102271647",
                "173771702568404679660825764862918366370",
                "38241033519424096437143560635772280848",
                "235354781614402218672049512363656655468",
                "280663953563104666954719227725936905345",
                "268097703864211277390832922796631741145",
                "91152359434758411962435263362267188234",
                "7694589537155536115591965992016084547",
                "20891382601161696051235033901994387193",
                "307277352426418026169516657601421100029",
                "164523768533611518640299380602584028522",
                "40047102688748895224771019519374644128",
                "270668712319937779497154697286649443154",
                "259184493381123064814045941281223646830",
                "242023666508320512296838515213353493914",
                "207891697706325101550846901025508815763"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-51738-644dbfda",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/lizardbyte/sunshine/commit/89f097ae65277d42b5d40163d09d92e412e6d7dd",
        "target": {
            "file": "src/nvhttp.cpp"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "7431955528319012413095498848644670818",
            "length": 770
        },
        "id": "CVE-2024-51738-dcd74b08",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/lizardbyte/sunshine/commit/89f097ae65277d42b5d40163d09d92e412e6d7dd",
        "target": {
            "file": "src/nvhttp.cpp",
            "function": "getservercert"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "55835972688758292967942987376578346282",
            "length": 3999
        },
        "id": "CVE-2024-51738-e3f962aa",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/lizardbyte/sunshine/commit/89f097ae65277d42b5d40163d09d92e412e6d7dd",
        "target": {
            "file": "src/nvhttp.cpp",
            "function": "start"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "19570670421250229369263525966128801134",
            "length": 1172
        },
        "id": "CVE-2024-51738-e538e4bb",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/lizardbyte/sunshine/commit/89f097ae65277d42b5d40163d09d92e412e6d7dd",
        "target": {
            "file": "src/nvhttp.cpp",
            "function": "clientchallenge"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T15:13:10Z"