CVE-2024-3935: eclipse foundation mosquitto Double Free
Vulnerability summary
CVE-2024-3935 is a medium (CVSS 6.5) Double Free vulnerability in eclipse foundation mosquitto. EPSS estimates a 0.75% chance of exploitation in the next 30 days, higher than 54.1% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 30-10-2024PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if the remote connection sends a crafted PUBLISH packet to the broker a double free will occur with a subsequent crash of the broker.
CVSS metrics
6 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.0MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
- NVDNIST6.0MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.75%
Chance of exploitation in the next 30 days
Percentile
54%
Versus all other CVEs
30-day change
0.00 pp
From 0.75% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (gitlab.eclipse.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian1 product
- mosquitto< 2.0.11-1.2+deb12u2 | < 2.0.20-1
Eclipse1 product
- mosquitto≥ 2.0.0, < 2.0.19
Eclipse foundation1 product
- mosquitto≥ 2.0.0, ≤ 2.0.18
Opensuse1 product
- mosquitto&distro=openSUSE Tumbleweed< 2.0.21-2.1
Ubuntu1 product
- mosquitto< 2.0.11-1ubuntu1.2 | < 2.0.18-1ubuntu0.1~esm1
5 vendors · 5 products
References
10 links- gitlab.eclipse.org/security/vulnerability-reports/-/issues/197REPORTExploitIssue TrackingVendor Advisory
- lists.opensuse.org/archives/…Advisory