Eclipse Mosquito: Double free vulnerability
Priority LOW 34CWE-415Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if the remote connection sends a crafted PUBLISH packet to the broker a double free will occur with a subsequent crash of the broker.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00749 55th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | mosquitto | 2.0.0 – 2.0.18 | — | No fix listed | CNA |
- mosquitto VendorEclipse Foundation Affected 2.0.0 – 2.0.18 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:mosquitto:*:*:*:*:*:*:*:* | 2.0.0 to before 2.0.19 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:mosquitto:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.0.19 Vulnerable ·Eclipse Foundation
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-3935
- 2026-10-03 Alias added: GHSA-r5mw-c5jc-r788
References
More Eclipse Foundation Mosquitto vulnerabilities
- TI-2024-09749 Eclipse Mosquito: Heap Buffer Overflow in my_subscribe_callback CVSS 4.0HIGH 7.2
- TI-2018-09002 Reachable assertion in Eclipse Mosquitto CVSS 3.0HIGH 7.5
- TI-2023-12912 The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that… CVSS 3.1HIGH 7.5
- TI-2017-05287 Uncontrolled resource consumption in Eclipse Mosquitto CVSS 3.0HIGH 7.5
- TI-2023-05183 Unconditionally adding an event to the epoll causes excessive CPU consumption CVSS 3.1HIGH 7.5
- TI-2018-09010 Improper authentication in Eclipse Mosquitto CVSS 3.0HIGH 8.1
Sources
- CVE-2024-3935 · CVE Program
- CVE-2024-3935 · NVD
- FIRST EPSS
- GHSA-r5mw-c5jc-r788 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences