{
  "cveId": "CVE-2024-3935",
  "url": "https://patchblox.com/security/cve/CVE-2024-3935",
  "summary": "CVE-2024-3935 is fixed in 4 products on 1 platform, first by libmosquitto1 2.0.11-1ubuntu1.2, released October 30, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "mosquitto: In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing br...",
  "description": "In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if the remote connection sends a crafted PUBLISH packet to the broker a double free will occur with a subsequent crash of the broker.",
  "published": "2024-10-30T05:15:00Z",
  "severity": "medium",
  "cvss": 6.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00749,
  "epssPercentile": 0.55182,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "libmosquitto1",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2.0.11-1ubuntu1.2",
      "fix": "libmosquitto1 2.0.11-1ubuntu1.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-libmosquitto1-2.0.11-1ubuntu1.2",
      "released": "2024-10-30T05:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libmosquitto1",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "2.0.18-1ubuntu0.1~esm1",
      "fix": "libmosquitto1 2.0.18-1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-libmosquitto1-2.0.18-1ubuntu0.1-esm1",
      "released": "2024-10-30T05:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libmosquittopp1",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2.0.11-1ubuntu1.2",
      "fix": "libmosquittopp1 2.0.11-1ubuntu1.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-libmosquittopp1-2.0.11-1ubuntu1.2",
      "released": "2024-10-30T05:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libmosquittopp1",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "2.0.18-1ubuntu0.1~esm1",
      "fix": "libmosquittopp1 2.0.18-1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-libmosquittopp1-2.0.18-1ubuntu0.1-esm1",
      "released": "2024-10-30T05:15:00Z"
    },
    {
      "platform": "linux",
      "product": "mosquitto",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "2.0.11-1.2\u002Bdeb12u2",
      "fix": "DEBIAN-CVE-2024-3935",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-3935",
      "released": "2024-10-30T12:15:03Z"
    },
    {
      "platform": "linux",
      "product": "mosquitto",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "2.0.20-1",
      "fix": "DEBIAN-CVE-2024-3935",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-3935",
      "released": "2024-10-30T12:15:03Z"
    },
    {
      "platform": "linux",
      "product": "mosquitto",
      "release": "Debian 14",
      "fixedVersion": "2.0.20-1",
      "fix": "DEBIAN-CVE-2024-3935",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-3935",
      "released": "2024-10-30T12:15:03Z"
    },
    {
      "platform": "linux",
      "product": "mosquitto",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2.0.11-1ubuntu1.2",
      "fix": "mosquitto 2.0.11-1ubuntu1.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-mosquitto-2.0.11-1ubuntu1.2",
      "released": "2024-10-30T05:15:00Z"
    },
    {
      "platform": "linux",
      "product": "mosquitto",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "2.0.18-1ubuntu0.1~esm1",
      "fix": "mosquitto 2.0.18-1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-mosquitto-2.0.18-1ubuntu0.1-esm1",
      "released": "2024-10-30T05:15:00Z"
    },
    {
      "platform": "linux",
      "product": "mosquitto",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "2.0.23-bp160.1.1",
      "fix": "OPENSUSE-SU-2026:20260-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-20260-1",
      "released": "2026-02-23T18:17:43Z"
    },
    {
      "platform": "linux",
      "product": "mosquitto-clients",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2.0.11-1ubuntu1.2",
      "fix": "mosquitto-clients 2.0.11-1ubuntu1.2",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-mosquitto-clients-2.0.11-1ubuntu1.2",
      "released": "2024-10-30T05:15:00Z"
    },
    {
      "platform": "linux",
      "product": "mosquitto-clients",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "2.0.18-1ubuntu0.1~esm1",
      "fix": "mosquitto-clients 2.0.18-1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-mosquitto-clients-2.0.18-1ubuntu0.1-esm1",
      "released": "2024-10-30T05:15:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}