{"id":"CVE-2024-3935","summary":"Eclipse Mosquito: Double free vulnerability","details":"In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if the remote connection sends a crafted PUBLISH packet to the broker a double free will occur with a subsequent crash of the broker.","modified":"2026-08-27T09:37:37.582043Z","published":"2024-10-30T11:45:23.506Z","related":["openSUSE-SU-2025:15074-1","openSUSE-SU-2026:20260-1"],"database_specific":{"cna_assigner":"eclipse","cwe_ids":["CWE-415"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3935.json"},"references":[{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00022.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3935.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3935"},{"type":"REPORT","url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/197"},{"type":"FIX","url":"https://github.com/eclipse-mosquitto/mosquitto/commit/ae7a804dadac8f2aaedb24336df8496a9680fda9"},{"type":"PACKAGE","url":"https://github.com/eclipse/mosquitto"},{"type":"ARTICLE","url":"https://mosquitto.org/blog/2024/10/version-2-0-19-released/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/eclipse-mosquitto/mosquitto","events":[{"introduced":"c00671af5c25593bebf065ed8820f7f00ee85efe"},{"fixed":"5eb40ee3d691fb3c2dc222685e7ffcf6e6a69a79"},{"fixed":"ae7a804dadac8f2aaedb24336df8496a9680fda9"}],"database_specific":{"cpe":"cpe:2.3:a:eclipse:mosquitto:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2.0.0"},{"fixed":"2.0.19"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v2.0.18","v2.0.17","v2.0.16","v2.0.15","v2.0.14","v2.0.13","v2.0.12","v2.0.11","v2.0.10","v2.0.9","v2.0.8","v2.0.7","v2.0.6","v2.0.5","v2.0.4","v2.0.3","v2.0.2","v2.0.1","v2.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-3935.json","vanir_signatures_modified":"2026-08-27T09:37:37Z","vanir_signatures":[{"id":"CVE-2024-3935-4a5d9c3c","signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-mosquitto/mosquitto/commit/ae7a804dadac8f2aaedb24336df8496a9680fda9","target":{"file":"src/bridge_topic.c","function":"bridge__remap_topic_in"},"deprecated":false,"digest":{"function_hash":"4903446295530044466165965109275383014","length":1233}},{"signature_version":"v1","source":"https://github.com/eclipse-mosquitto/mosquitto/commit/5eb40ee3d691fb3c2dc222685e7ffcf6e6a69a79","target":{"file":"src/bridge.c"},"deprecated":false,"digest":{"line_hashes":["112744184638913340540592059009065155160","173647425033737941360091521005652606556","129426418706414116545542920680687959565","177013983548820522005115672949777997892","261027843247209851251118222858259184730"],"threshold":0.9},"id":"CVE-2024-3935-5d3333ec","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"328300029930406813138797490881719136165","length":3362},"id":"CVE-2024-3935-73c66614","signature_type":"Function","signature_version":"v1","source":"https://github.com/eclipse-mosquitto/mosquitto/commit/5eb40ee3d691fb3c2dc222685e7ffcf6e6a69a79","target":{"file":"src/bridge.c","function":"bridge__connect_step1"}},{"deprecated":false,"digest":{"line_hashes":["325858421244081329591297766335647296353","223014989178751507032202440944436668538","110769814546166323054287558399514471299","198384982897770075015495544644726429398","31331637370166039020317672120484360290","25714137332021155978064129519918792141","37604732910625556890916842660397074367","205831952070301956906245517838921630267","48473777047675531720449935143801671646","202236895513636054127209375239737993608","37604732910625556890916842660397074367","326358151478828888483754458157644801982"],"threshold":0.9},"id":"CVE-2024-3935-9addcbdd","signature_type":"Line","signature_version":"v1","source":"https://github.com/eclipse-mosquitto/mosquitto/commit/ae7a804dadac8f2aaedb24336df8496a9680fda9","target":{"file":"src/bridge_topic.c"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"}]}