Meshtastic is an open source mesh networking solution. From 1.2.1 until 2.6.2, a packet sent to the routing module that contains want_response==true causes a crash. This can lead to a degradation of service for nodes within range of a malicious sender, or via MQTT if downlink is enabled. This vulnerability is fixed in 2.6.2.
{
"cna_assigner": "GitHub_M",
"cwe_ids": [
"CWE-617"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/24xxx/CVE-2025-24798.json"
}{
"extracted_events": [
{
"range": [
{
"introduced": "1.2.1"
},
{
"fixed": "2.6.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "dc100e4d3e3dfbf58d3ead8141a49cddb0cbdc19"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-24798.json"
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"279636855736737004067448751188153471160",
"47782321091749942946081627471881459811",
"62722362435446960197396408129822419087",
"211483692755841522376247629832111535983",
"297371693125231527111453599219694824426",
"146496980635304459174196106412041692953",
"293486156329015742063011249482298644419",
"242953412575417169192260890234431966717",
"16689732991326498427140553509151046022",
"194847453114739928568703271990851002057",
"186970573076971743025468445686571500504",
"4678797514517580389593531373918970931",
"69964474477979290669529943070053840808",
"49389994319515715379935039999813540553",
"324636852759489727999402417659188880663",
"154184660449543747312356975098226959176",
"184536904327360789899167979156660973802",
"236373806081595117188254341018111542622",
"116769393590536160571749372599459803648",
"231604248155529335459336111930891061420",
"80647518083440619297008676654568037528",
"65462871949407833443451970573078959391",
"226905465073897605384157289235982821170",
"250604889259446491884809381418278471702",
"88563890126349930520583261722697761260",
"98582939126904270853523198261170933990",
"54016366606474754515135797502875811976",
"115887759578971310320920393656713726324",
"193960506089647390053754427884703558674",
"197522460699459429865819029306100301803",
"172715391346707962242050417892006477170",
"76875202143384314919677864674529383412",
"181426376870502190201508109058432927192",
"277543218451243647067498016950221366874",
"147496162036257610933221087485068101319",
"296391157821390368495874524620230049786",
"279066974648986174261919425817302922139",
"309654103329069250846117093717562613201",
"76580041821054156526901885655291387640",
"275759097687305870653152651759984836830",
"96134294576277881774172788257998566192",
"188569391550281424422974647490273840026",
"20537599863478110046279075238547144247",
"38977193014213883729741300088412582714",
"298030565025912929909694011502028399246",
"84899360939385998351792257304816626115",
"175250066023227628535120319721707175182",
"241969724037040460297030156771614329318",
"255279762790419404507335392209280867947",
"253920260507759527909887616036547485575",
"336667633787016476863178598812895945549",
"263733457536512166927352981753515130880",
"287834928119153638123065836663145169996",
"265646255843341284616158866497959715864",
"193037665756624451335752047373896925604",
"197875380844318840481134545606332093557",
"22650241285768593434120463431213418336",
"142570186361816833286891854715308652609",
"125381315358048043294550955143990994064",
"154983275631601053282110223960607125139",
"250627923281223108328142631721174200789",
"244329209720421136378049926795274607626",
"166041811407126918775200255745199804931",
"77519661092240239624777136572555196159",
"133266762196217754193473235197620255154",
"66711003378323052066230058529910411403",
"229719811158437044344262428471396382396",
"285845241851873004899556965855988671900",
"316318970078670562384099528840035930538",
"180640528375001120237174162699648850752",
"284556544544394057010314181672375888718"
],
"threshold": 0.9
},
"id": "CVE-2025-24798-0138f2cf",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meshtastic/firmware/commit/dc100e4d3e3dfbf58d3ead8141a49cddb0cbdc19",
"target": {
"file": "src/mesh/Router.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "120624635088259174361320556151462810292",
"length": 2092
},
"id": "CVE-2025-24798-0347ddfc",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meshtastic/firmware/commit/dc100e4d3e3dfbf58d3ead8141a49cddb0cbdc19",
"target": {
"file": "src/mesh/Router.cpp",
"function": "Router::handleReceived"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"195659033143348481727302496703813239828",
"5990707896575896476230205829740061934",
"15035636744481382098578815078890551282",
"166428469924591568738441057514468657311",
"85754664339158242199337022534518101486",
"258759874669549951103560187280277689651",
"37406407200943491603793786784284558942"
],
"threshold": 0.9
},
"id": "CVE-2025-24798-0f800810",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meshtastic/firmware/commit/dc100e4d3e3dfbf58d3ead8141a49cddb0cbdc19",
"target": {
"file": "src/SafeFile.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "236767447069982763645509549267167264901",
"length": 3578
},
"id": "CVE-2025-24798-0f92df7c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meshtastic/firmware/commit/dc100e4d3e3dfbf58d3ead8141a49cddb0cbdc19",
"target": {
"file": "src/mesh/Router.cpp",
"function": "perhapsDecode"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "245210903505394026043325024741897715508",
"length": 1758
},
"id": "CVE-2025-24798-11af00a1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meshtastic/firmware/commit/31c0e8fa2ca0cce903e73749454324c672c18b4c",
"target": {
"file": "src/platform/esp32/main-esp32.cpp",
"function": "esp32Setup"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"192190252345018864318593294485864181049",
"145037470452886879997689772345083969142",
"6278368742130606180249209328911217689",
"270599183331784782884048415796380119425"
],
"threshold": 0.9
},
"id": "CVE-2025-24798-1a7605b8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meshtastic/firmware/commit/dc100e4d3e3dfbf58d3ead8141a49cddb0cbdc19",
"target": {
"file": "src/mesh/MeshService.h"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "203981618274273303549158008708915952969",
"length": 520
},
"id": "CVE-2025-24798-1ee5ac5e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meshtastic/firmware/commit/dc100e4d3e3dfbf58d3ead8141a49cddb0cbdc19",
"target": {
"file": "src/mesh/NodeDB.cpp",
"function": "NodeDB::resetRadioConfig"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"61906178065152490745645933840680174577",
"28946009239950095414879604145601960566",
"60649532268409851977496238090324167516",
"200634508803862953288748608943237796601",
"244993196823156081938587012998377171933",
"314997957164196178084788819934505000108",
"274879986595756875548178437855315468027",
"182270819984620945240112518637550383490",
"131031132699406139319836751897879463449",
"315061169634299417854061116329323171859",
"13850273912623731527025627215546501489",
"3732993753203446154982775224464466777",
"57701735102792753932437450714014955231",
"151727272169547227909156775003071831656",
"158085038331930558469295460800969735618",
"232610998719035549098107118297606687147",
"131914005922832595584348032757712868036",
"201421653561029527719338601750206488790",
"83125320712499385149269695774695540630",
"275419980576526112675236469812557313254"
],
"threshold": 0.9
},
"id": "CVE-2025-24798-2480b0c3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meshtastic/firmware/commit/31c0e8fa2ca0cce903e73749454324c672c18b4c",
"target": {
"file": "src/modules/AdminModule.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "101724645699819884445807792635774847413",
"length": 6220
},
"id": "CVE-2025-24798-4d6f4b81",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meshtastic/firmware/commit/dc100e4d3e3dfbf58d3ead8141a49cddb0cbdc19",
"target": {
"file": "src/mesh/NodeDB.cpp",
"function": "NodeDB::installDefaultConfig"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"249284301546385323913208866798342752033",
"148313737138677794687914364016057942736",
"125503957719484020501243424300724351197",
"190001140620202926798782202257677909227",
"3052219449725424921911434118194674663",
"326526716262538329982181416973430293668",
"220183260852286607517051190966862909215",
"66875154906076421416391399934220641088",
"309957815677007174062473363833019292325",
"185962665488891403066726700657332529563",
"128188205448738089204241983939314957855",
"307694384273612590918886186445643392808"
],
"threshold": 0.9
},
"id": "CVE-2025-24798-5291d4f9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meshtastic/firmware/commit/31c0e8fa2ca0cce903e73749454324c672c18b4c",
"target": {
"file": "src/platform/esp32/main-esp32.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"126863836065188641775541385997645727448",
"16337665609906186496300514066365185214",
"81925465350284162521963528743382684687",
"134823300664895753233529764267079026882",
"26655964320300346907606394168116747416",
"225614447189530832314127217437236458197",
"281660926303554249493409019928214063513",
"285926693272117415475339890930206416927"
],
"threshold": 0.9
},
"id": "CVE-2025-24798-5a0143c3",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meshtastic/firmware/commit/dc100e4d3e3dfbf58d3ead8141a49cddb0cbdc19",
"target": {
"file": "src/mesh/Router.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"32852489219959112327554815576849505039",
"323427157261597206057375546355823263800",
"49225056671643197842780058550444622195",
"156071313423101647954606276822469646178",
"291680843497433762174599223773658160022",
"183446017861714925544341208622625832894",
"260877638887221973719524256999273673434",
"324632211514328920653999789898749812104",
"282344293357208978258990446978970323901"
],
"threshold": 0.9
},
"id": "CVE-2025-24798-84dac2f8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meshtastic/firmware/commit/dc100e4d3e3dfbf58d3ead8141a49cddb0cbdc19",
"target": {
"file": "src/mesh/MeshService.cpp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"153498025880877705999921041995657176973",
"171112842908568311377591344767391092572",
"277688959523786653960109897203453288473",
"167132730295649135692197421256074469448"
],
"threshold": 0.9
},
"id": "CVE-2025-24798-aac25cd1",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meshtastic/firmware/commit/dc100e4d3e3dfbf58d3ead8141a49cddb0cbdc19",
"target": {
"file": "src/mqtt/MQTT.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "42398819902705258583386768832457477174",
"length": 382
},
"id": "CVE-2025-24798-ade12936",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meshtastic/firmware/commit/dc100e4d3e3dfbf58d3ead8141a49cddb0cbdc19",
"target": {
"file": "src/SafeFile.cpp",
"function": "openFile"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"35239100753999571278489128282348647715",
"167292616011900976416875558514058833565",
"124319307342312500080418257644756458633",
"213353777993448751522806312268417114309"
],
"threshold": 0.9
},
"id": "CVE-2025-24798-ae0e3013",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meshtastic/firmware/commit/dc100e4d3e3dfbf58d3ead8141a49cddb0cbdc19",
"target": {
"file": "src/mesh/NodeDB.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"157028119273078904388366807361782769151",
"130240107725845285756601425496754889734",
"219349541726383821368887098131781642516",
"194739442077455697712203997410635235067",
"328485620285143399539071929614256745831",
"51268563524883632824981617301327314833",
"152808718208507267653825078514319806627",
"192139202282636903743323774315190049681",
"34948087552295029133806623107897880391",
"127967070230061795964636716897343311677",
"67061355135896726410964246088166967104",
"328433927064523118694816817212047298915",
"44458735657902087196969530671449859244",
"321075687957338671526745625665479957099",
"246343619624628032490449839646114081156",
"262802249137697810175378004470606711550",
"250743812320154070434109583104708901625",
"320635718813780971628005491557777190639",
"119903457056765209199795842110504447055",
"305182675579555189531228763711301759471",
"162275092552653319745073271562932086937",
"167231007686570698321853764669289940154",
"262110897971132355832756698785773377188",
"314775282386387729846009961353737335832",
"11563808010031111059304772223575720739"
],
"threshold": 0.9
},
"id": "CVE-2025-24798-c791e7bf",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meshtastic/firmware/commit/dc100e4d3e3dfbf58d3ead8141a49cddb0cbdc19",
"target": {
"file": "src/mesh/NodeDB.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "273999714152949001576815024458923749623",
"length": 12256
},
"id": "CVE-2025-24798-ccc3d79f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meshtastic/firmware/commit/31c0e8fa2ca0cce903e73749454324c672c18b4c",
"target": {
"file": "src/modules/AdminModule.cpp",
"function": "AdminModule::handleReceivedProtobuf"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "52421195812004171653723485159964723415",
"length": 277
},
"id": "CVE-2025-24798-ec381d8b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meshtastic/firmware/commit/dc100e4d3e3dfbf58d3ead8141a49cddb0cbdc19",
"target": {
"file": "src/modules/RoutingModule.cpp",
"function": "RoutingModule::allocReply"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"20072948030098165390340088063728567849",
"235309584688465712793709454483205567038",
"27027538844266934550642619104266011877",
"296417525711632723101399412788344335661",
"153704117802866026979345740852789933628",
"328859565303212311607873175220977726853"
],
"threshold": 0.9
},
"id": "CVE-2025-24798-ef7b73ea",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meshtastic/firmware/commit/dc100e4d3e3dfbf58d3ead8141a49cddb0cbdc19",
"target": {
"file": "src/modules/RoutingModule.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "210154925648406386319680429687343416354",
"length": 2680
},
"id": "CVE-2025-24798-efe470cd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meshtastic/firmware/commit/dc100e4d3e3dfbf58d3ead8141a49cddb0cbdc19",
"target": {
"file": "src/mqtt/MQTT.cpp",
"function": "onReceiveProto"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"210944701493888918452618757947716232777",
"274498763366856031275542581244327166561",
"63779957033052144137676142765187539423"
],
"threshold": 0.9
},
"id": "CVE-2025-24798-f5e70019",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/meshtastic/firmware/commit/dc100e4d3e3dfbf58d3ead8141a49cddb0cbdc19",
"target": {
"file": "src/mesh/RadioInterface.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "114464671347696187105685706675675960261",
"length": 1144
},
"id": "CVE-2025-24798-f5ea2772",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meshtastic/firmware/commit/dc100e4d3e3dfbf58d3ead8141a49cddb0cbdc19",
"target": {
"file": "src/mesh/RadioInterface.cpp",
"function": "RadioInterface::beginSending"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "14957758541921926575306226160860478712",
"length": 187
},
"id": "CVE-2025-24798-fab4c37f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/meshtastic/firmware/commit/dc100e4d3e3dfbf58d3ead8141a49cddb0cbdc19",
"target": {
"file": "src/mesh/MeshService.cpp",
"function": "MeshService::reloadConfig"
}
}
]
"2026-10-21T09:05:41Z"