Description
In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if the remote connection sends a crafted PUBLISH packet to the broker a double free will occur with a subsequent crash of the broker.
Published: 2024-10-30
Score: 6 Medium
EPSS: < 1% Very Low
KEV: No
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4059-1 mosquitto security update
EUVD EUVD EUVD-2024-32502 In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if the remote connection sends a crafted PUBLISH packet to the broker a double free will occur with a subsequent crash of the broker.
Ubuntu USN Ubuntu USN USN-7441-1 Eclipse Mosquitto vulnerabilities
History

Mon, 03 Nov 2025 22:30:00 +0100

Type Values Removed Values Added
References

Wed, 16 Jul 2025 15:45:00 +0200

Type Values Removed Values Added
Metrics epss

{'score': 0.0032}

 epss

{'score': 0.00374}

Wed, 29 Jan 2025 18:30:00 +0100

Type Values Removed Values Added
First Time appeared Eclipse
Eclipse mosquitto
CPEs cpe:2.3:a:eclipse:mosquitto:*:*:*:*:*:*:*:*
Vendors & Products Eclipse
Eclipse mosquitto
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Thu, 09 Jan 2025 19:45:00 +0100

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Thu, 31 Oct 2024 10:30:00 +0100

Type Values Removed Values Added
References

Wed, 30 Oct 2024 15:15:00 +0100

Type Values Removed Values Added
First Time appeared Eclipse Foundation
Eclipse Foundation mosquitto
CPEs cpe:2.3:a:eclipse_foundation:mosquitto:*:*:*:*:*:*:*:*
Vendors & Products Eclipse Foundation
Eclipse Foundation mosquitto
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 30 Oct 2024 13:00:00 +0100

Type Values Removed Values Added
Description In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if the remote connection sends a crafted PUBLISH packet to the broker a double free will occur with a subsequent crash of the broker.
Title Eclipse Mosquito: Double free vulnerability
Weaknesses CWE-415
References
Metrics cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Eclipse Mosquitto
Eclipse Foundation Mosquitto
cve-icon MITRE

Status: PUBLISHED

Assigner: eclipse

Published:

Updated: 2025-11-03T20:38:15.605Z

Reserved: 2024-04-17T17:12:36.491Z

Link: CVE-2024-3935

cve-icon Vulnrichment

Updated: 2025-11-03T20:38:15.605Z

cve-icon NVD

Status : Modified

Published: 2024-10-30T12:15:03.090

Modified: 2026-06-17T07:45:30.607

Link: CVE-2024-3935

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses