CVE catalog

CVE-2024-3935

Eclipse Mosquitto vulnerabilities

Severity: Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published: Oct 30, 2024, 12:15:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.75% · Oct 25, 2026

In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if the remote connection sends a crafted PUBLISH packet to the broker a double free will occur with a subsequent crash of the broker.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	mosquitto	sid	`2.1.2-3`	fixed
Debian	mosquitto	forky	`2.1.2-3`	fixed
Debian	mosquitto	trixie	`2.0.21-1`	fixed
Debian	mosquitto	bookworm	`2.0.11-1.2+deb12u2`	fixed
Debian	mosquitto	bookworm-security	`2.0.11-1.2+deb12u1`	vulnerable
Ubuntu	mosquitto	noble	`2.0.18-1ubuntu0.1~esm1`	fixed
Ubuntu	libmosquitto-dev	noble	`2.0.18-1ubuntu0.1~esm1`	fixed
Ubuntu	libmosquitto1	noble	`2.0.18-1ubuntu0.1~esm1`	fixed
Ubuntu	libmosquittopp-dev	noble	`2.0.18-1ubuntu0.1~esm1`	fixed
Ubuntu	libmosquittopp1	noble	`2.0.18-1ubuntu0.1~esm1`	fixed
Ubuntu	mosquitto-clients	noble	`2.0.18-1ubuntu0.1~esm1`	fixed
Ubuntu	mosquitto-dev	noble	`2.0.18-1ubuntu0.1~esm1`	fixed
Ubuntu	mosquitto	noble	`2.0.11-1.2+deb12u2`	fixed
Ubuntu	mosquitto	22.04	`2.0.11-1`	vulnerable
Ubuntu	mosquitto	22.04	`2.0.11-1build1`	vulnerable
Ubuntu	mosquitto	22.04	`2.0.11-1ubuntu1`	vulnerable
Ubuntu	mosquitto	22.04	`2.0.11-1ubuntu1.1`	vulnerable
Ubuntu	mosquitto	22.04	`2.0.11-1ubuntu1.2`	fixed
Ubuntu	mosquitto	pro	`2.0.18-1`	vulnerable
Ubuntu	mosquitto	pro	`2.0.18-1build1`	vulnerable
Ubuntu	mosquitto	pro	`2.0.18-1build2`	vulnerable
Ubuntu	mosquitto	pro	`2.0.18-1build3`	vulnerable
Ubuntu	mosquitto	pro	`2.0.18-1ubuntu0.1~esm1`	fixed
Opensuse	mosquitto	tumbleweed	`2.0.21-2.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	mosquitto	source	sid	`2.0.20-1`	not yet assigned	Not reported	Not reported
Debian	mosquitto	source	forky	`2.0.20-1`	not yet assigned	Not reported	Not reported
Debian	mosquitto	source	trixie	`2.0.20-1`	not yet assigned	Not reported	Not reported
Debian	mosquitto	source	bookworm	`2.0.11-1.2+deb12u2`	not yet assigned	Not reported	Not reported
Ubuntu	mosquitto	deb	noble	`2.0.18-1ubuntu0.1~esm1`	Not reported	Not reported	Not reported
Ubuntu	libmosquitto-dev	deb	noble	`2.0.18-1ubuntu0.1~esm1`	Not reported	Not reported	Not reported
Ubuntu	libmosquitto1	deb	noble	`2.0.18-1ubuntu0.1~esm1`	Not reported	Not reported	Not reported
Ubuntu	libmosquittopp-dev	deb	noble	`2.0.18-1ubuntu0.1~esm1`	Not reported	Not reported	Not reported
Ubuntu	libmosquittopp1	deb	noble	`2.0.18-1ubuntu0.1~esm1`	Not reported	Not reported	Not reported
Ubuntu	mosquitto-clients	deb	noble	`2.0.18-1ubuntu0.1~esm1`	Not reported	Not reported	Not reported
Ubuntu	mosquitto-dev	deb	noble	`2.0.18-1ubuntu0.1~esm1`	Not reported	Not reported	Not reported
Ubuntu	mosquitto	deb	noble	`2.0.11-1.2+deb12u2`	Not reported	Not reported	Not reported
Ubuntu	mosquitto	deb	22.04	`2.0.11-1ubuntu1.2`	Not reported	UBUNTU-CVE-2024-3935	Not reported
Ubuntu	mosquitto	deb	pro	`2.0.18-1ubuntu0.1~esm1`	Not reported	UBUNTU-CVE-2024-3935	Not reported
Opensuse	mosquitto	rpm	tumbleweed	`2.0.21-2.1`	Not reported	OPENSUSE-SU-2025:15074-1	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libmosquitto1]Affected
Source package: [mosquitto]
Details (6)
- 2.0.11-1.2+deb12u2 · amd64 · bookworm
  Fixed · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.11-1.2+deb12u2 · arm64 · bookworm
  Fixed · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.21-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.21-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.11-1.2+deb12u1 · amd64 · bookworm-security
  Affected · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.11-1.2+deb12u1 · arm64 · bookworm-security
  Affected · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
[libmosquitto-dev]Affected
Source package: [mosquitto]
Details (6)
- 2.0.11-1.2+deb12u2 · amd64 · bookworm
  Fixed · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.11-1.2+deb12u2 · arm64 · bookworm
  Fixed · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.21-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.21-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.11-1.2+deb12u1 · amd64 · bookworm-security
  Affected · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.11-1.2+deb12u1 · arm64 · bookworm-security
  Affected · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
[libmosquittopp1]Affected
Source package: [mosquitto]
Details (6)
- 2.0.11-1.2+deb12u2 · amd64 · bookworm
  Fixed · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.11-1.2+deb12u2 · arm64 · bookworm
  Fixed · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.21-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.21-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.11-1.2+deb12u1 · amd64 · bookworm-security
  Affected · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.11-1.2+deb12u1 · arm64 · bookworm-security
  Affected · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
[libmosquittopp-dev]Affected
Source package: [mosquitto]
Details (6)
- 2.0.11-1.2+deb12u2 · amd64 · bookworm
  Fixed · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.11-1.2+deb12u2 · arm64 · bookworm
  Fixed · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.21-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.21-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.11-1.2+deb12u1 · amd64 · bookworm-security
  Affected · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.11-1.2+deb12u1 · arm64 · bookworm-security
  Affected · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
[mosquitto]Affected
Details (6)
- 2.0.11-1.2+deb12u2 · amd64 · bookworm
  Fixed · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.11-1.2+deb12u2 · arm64 · bookworm
  Fixed · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.21-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.21-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.11-1.2+deb12u1 · amd64 · bookworm-security
  Affected · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.11-1.2+deb12u1 · arm64 · bookworm-security
  Affected · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
[mosquitto-clients]Affected
Source package: [mosquitto]
Details (6)
- 2.0.11-1.2+deb12u2 · amd64 · bookworm
  Fixed · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.11-1.2+deb12u2 · arm64 · bookworm
  Fixed · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.21-1~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.21-1~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.11-1.2+deb12u1 · amd64 · bookworm-security
  Affected · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.11-1.2+deb12u1 · arm64 · bookworm-security
  Affected · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
[mosquitto-dev]Affected
Source package: [mosquitto]
Details (6)
- 2.0.11-1.2+deb12u2 · all · bookworm
  Fixed · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.11-1.2+deb12u2 · all · bookworm
  Fixed · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.21-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.21-1~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.11-1.2+deb12u1 · all · bookworm-security
  Affected · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12
- 2.0.11-1.2+deb12u1 · all · bookworm-security
  Affected · Fixed: 2.0.11-1.2+deb12u2
  usn · mosquitto · debian · bookworm; usn · mosquitto · debian · 12

[openSUSE Tumbleweed]

[libmosquitto1]Unknown
Source package: [mosquitto]
Details (1)
- 2.0.23-1.5 · x86_64 · tumbleweed
  Unknown · Fixed: 2.0.21-2.1
  Version impact unknown
  usn · mosquitto · opensuse · tumbleweed
[libmosquittopp1]Unknown
Source package: [mosquitto]
Details (1)
- 2.0.23-1.5 · x86_64 · tumbleweed
  Unknown · Fixed: 2.0.21-2.1
  Version impact unknown
  usn · mosquitto · opensuse · tumbleweed
[mosquitto-clients]Unknown
Source package: [mosquitto]
Details (1)
- 2.0.23-1.5 · x86_64 · tumbleweed
  Unknown · Fixed: 2.0.21-2.1
  Version impact unknown
  usn · mosquitto · opensuse · tumbleweed
[mosquitto-devel]Unknown
Source package: [mosquitto]
Details (1)
- 2.0.23-1.5 · x86_64 · tumbleweed
  Unknown · Fixed: 2.0.21-2.1
  Version impact unknown
  usn · mosquitto · opensuse · tumbleweed
[mosquitto]Fixed
Source package: [mosquitto]
Details (1)
- 2.0.23-1.5 · x86_64 · tumbleweed
  Fixed · Fixed: 2.0.21-2.1
  usn · mosquitto · opensuse · tumbleweed

[Debian 13 (Trixie)]

[libmosquitto1]Fixed
Source package: [mosquitto]
Details (2)
- 2.0.21-1 · amd64 · trixie
  Fixed · Fixed: 2.0.20-1
  usn · mosquitto · debian · 13
- 2.0.21-1 · arm64 · trixie
  Fixed · Fixed: 2.0.20-1
  usn · mosquitto · debian · 13
[libmosquitto-dev]Fixed
Source package: [mosquitto]
Details (2)
- 2.0.21-1 · amd64 · trixie
  Fixed · Fixed: 2.0.20-1
  usn · mosquitto · debian · 13
- 2.0.21-1 · arm64 · trixie
  Fixed · Fixed: 2.0.20-1
  usn · mosquitto · debian · 13
[libmosquittopp1]Fixed
Source package: [mosquitto]
Details (2)
- 2.0.21-1 · amd64 · trixie
  Fixed · Fixed: 2.0.20-1
  usn · mosquitto · debian · 13
- 2.0.21-1 · arm64 · trixie
  Fixed · Fixed: 2.0.20-1
  usn · mosquitto · debian · 13
[libmosquittopp-dev]Fixed
Source package: [mosquitto]
Details (2)
- 2.0.21-1 · amd64 · trixie
  Fixed · Fixed: 2.0.20-1
  usn · mosquitto · debian · 13
- 2.0.21-1 · arm64 · trixie
  Fixed · Fixed: 2.0.20-1
  usn · mosquitto · debian · 13
[mosquitto]Fixed
Details (2)
- 2.0.21-1 · amd64 · trixie
  Fixed · Fixed: 2.0.20-1
  usn · mosquitto · debian · 13
- 2.0.21-1 · arm64 · trixie
  Fixed · Fixed: 2.0.20-1
  usn · mosquitto · debian · 13
[mosquitto-clients]Fixed
Source package: [mosquitto]
Details (2)
- 2.0.21-1 · amd64 · trixie
  Fixed · Fixed: 2.0.20-1
  usn · mosquitto · debian · 13
- 2.0.21-1 · arm64 · trixie
  Fixed · Fixed: 2.0.20-1
  usn · mosquitto · debian · 13
[mosquitto-dev]Fixed
Source package: [mosquitto]
Details (2)
- 2.0.21-1 · all · trixie
  Fixed · Fixed: 2.0.20-1
  usn · mosquitto · debian · 13
- 2.0.21-1 · all · trixie
  Fixed · Fixed: 2.0.20-1
  usn · mosquitto · debian · 13

Observed: Oct 27, 2026, 1:04:37 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]