CVE-2024-3935

MEDIUM

Eclipse Mosquitto 2.0.0-2.0.18 - Double Free via Crafted PUBLISH Packet in Bridge Connection

Title source: llm
STIX 2.1

Description

In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if the remote connection sends a crafted PUBLISH packet to the broker a double free will occur with a subsequent crash of the broker.

References (4)

Core 4

Scores

CVSS v3 6.5
EPSS 0.0076
EPSS Percentile 50.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-415
Status published
Products (1)
eclipse/mosquitto 2.0.0 - 2.0.19
Published Oct 30, 2024
Tracked Since Feb 18, 2026