CVE-2024-3935

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-3935
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-3935.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-3935
Downstream
Published
2024-10-30T12:15:03Z
Modified
2025-10-14T17:31:22.711246Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if the remote connection sends a crafted PUBLISH packet to the broker a double free will occur with a subsequent crash of the broker.

References

Affected packages

Git / github.com/eclipse-mosquitto/mosquitto

Affected ranges

Type
GIT
Repo
https://github.com/eclipse-mosquitto/mosquitto
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ae7a804dadac8f2aaedb24336df8496a9680fda9
Type
GIT
Repo
https://github.com/eclipse/mosquitto
Events
Introduced
c00671af5c25593bebf065ed8820f7f00ee85efe
Fixed
5eb40ee3d691fb3c2dc222685e7ffcf6e6a69a79

Affected versions

v1.*

v1.4
v1.4.1
v1.4.10
v1.4.11
v1.4.12
v1.4.13
v1.4.14
v1.4.15
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.4.6
v1.4.7
v1.4.8
v1.4.9
v1.5
v1.5.1
v1.5.2
v1.5.3
v1.5.4
v1.5.5
v1.5.7
v1.5.8
v1.6
v1.6.1
v1.6.10
v1.6.11
v1.6.12
v1.6.2
v1.6.3
v1.6.4
v1.6.5
v1.6.6
v1.6.7
v1.6.8
v1.6.9

v2.*

v2.0.0
v2.0.1
v2.0.10
v2.0.11
v2.0.12
v2.0.13
v2.0.14
v2.0.15
v2.0.16
v2.0.17
v2.0.18
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.0.6
v2.0.7
v2.0.8
v2.0.9

Database specific

vanir_signatures

[
    {
        "signature_type": "Function",
        "id": "CVE-2024-3935-34ff54b6",
        "source": "https://github.com/eclipse/mosquitto/commit/5eb40ee3d691fb3c2dc222685e7ffcf6e6a69a79",
        "signature_version": "v1",
        "target": {
            "function": "bridge__connect_step1",
            "file": "src/bridge.c"
        },
        "digest": {
            "function_hash": "328300029930406813138797490881719136165",
            "length": 3362.0
        },
        "deprecated": false
    },
    {
        "signature_type": "Function",
        "id": "CVE-2024-3935-4a5d9c3c",
        "source": "https://github.com/eclipse-mosquitto/mosquitto/commit/ae7a804dadac8f2aaedb24336df8496a9680fda9",
        "signature_version": "v1",
        "target": {
            "function": "bridge__remap_topic_in",
            "file": "src/bridge_topic.c"
        },
        "digest": {
            "function_hash": "4903446295530044466165965109275383014",
            "length": 1233.0
        },
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "id": "CVE-2024-3935-8f382462",
        "source": "https://github.com/eclipse/mosquitto/commit/5eb40ee3d691fb3c2dc222685e7ffcf6e6a69a79",
        "signature_version": "v1",
        "target": {
            "file": "src/bridge.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "112744184638913340540592059009065155160",
                "173647425033737941360091521005652606556",
                "129426418706414116545542920680687959565",
                "177013983548820522005115672949777997892",
                "261027843247209851251118222858259184730"
            ]
        },
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "id": "CVE-2024-3935-9addcbdd",
        "source": "https://github.com/eclipse-mosquitto/mosquitto/commit/ae7a804dadac8f2aaedb24336df8496a9680fda9",
        "signature_version": "v1",
        "target": {
            "file": "src/bridge_topic.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "325858421244081329591297766335647296353",
                "223014989178751507032202440944436668538",
                "110769814546166323054287558399514471299",
                "198384982897770075015495544644726429398",
                "31331637370166039020317672120484360290",
                "25714137332021155978064129519918792141",
                "37604732910625556890916842660397074367",
                "205831952070301956906245517838921630267",
                "48473777047675531720449935143801671646",
                "202236895513636054127209375239737993608",
                "37604732910625556890916842660397074367",
                "326358151478828888483754458157644801982"
            ]
        },
        "deprecated": false
    }
]