CVE-2024-3935 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2024-3935 Interim 1 9 2026-03-05T02:59:25Z current 2024-10-31T00:24:49Z 2026-03-05T02:59:25Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2024-3935 In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if the remote connection sends a crafted PUBLISH packet to the broker a double free will occur with a subsequent crash of the broker. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZVFEGLDJBY7EABGWWD3F2MDZ223VAMQ6/ E-Mail link for openSUSE-SU-2025:15074-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Package Hub 15 SP5 SUSE Package Hub 15 SP6 openSUSE Leap 15.5 openSUSE Leap 15.6 openSUSE Leap 16.0 openSUSE Tumbleweed libmosquitto1-2.0.20-bp155.3.3.1 libmosquitto1-2.0.21-2.1 libmosquitto1-2.0.21-bp156.2.6.1 libmosquitto1-2.0.23-bp160.1.1 libmosquittopp1-2.0.20-bp155.3.3.1 libmosquittopp1-2.0.21-2.1 libmosquittopp1-2.0.21-bp156.2.6.1 libmosquittopp1-2.0.23-bp160.1.1 mosquitto-2.0.20-bp155.3.3.1 mosquitto-2.0.21-2.1 mosquitto-2.0.21-bp156.2.6.1 mosquitto-2.0.23-bp160.1.1 mosquitto-clients-2.0.20-bp155.3.3.1 mosquitto-clients-2.0.21-2.1 mosquitto-clients-2.0.21-bp156.2.6.1 mosquitto-clients-2.0.23-bp160.1.1 mosquitto-devel-2.0.20-bp155.3.3.1 mosquitto-devel-2.0.21-2.1 mosquitto-devel-2.0.21-bp156.2.6.1 mosquitto-devel-2.0.23-bp160.1.1 libmosquitto1-2.0.20-bp155.3.3.1 as a component of SUSE Package Hub 15 SP5 libmosquittopp1-2.0.20-bp155.3.3.1 as a component of SUSE Package Hub 15 SP5 mosquitto-2.0.20-bp155.3.3.1 as a component of SUSE Package Hub 15 SP5 mosquitto-clients-2.0.20-bp155.3.3.1 as a component of SUSE Package Hub 15 SP5 mosquitto-devel-2.0.20-bp155.3.3.1 as a component of SUSE Package Hub 15 SP5 libmosquitto1-2.0.21-bp156.2.6.1 as a component of SUSE Package Hub 15 SP6 libmosquittopp1-2.0.21-bp156.2.6.1 as a component of SUSE Package Hub 15 SP6 mosquitto-2.0.21-bp156.2.6.1 as a component of SUSE Package Hub 15 SP6 mosquitto-clients-2.0.21-bp156.2.6.1 as a component of SUSE Package Hub 15 SP6 mosquitto-devel-2.0.21-bp156.2.6.1 as a component of SUSE Package Hub 15 SP6 libmosquitto1-2.0.20-bp155.3.3.1 as a component of openSUSE Leap 15.5 libmosquittopp1-2.0.20-bp155.3.3.1 as a component of openSUSE Leap 15.5 mosquitto-2.0.20-bp155.3.3.1 as a component of openSUSE Leap 15.5 mosquitto-clients-2.0.20-bp155.3.3.1 as a component of openSUSE Leap 15.5 mosquitto-devel-2.0.20-bp155.3.3.1 as a component of openSUSE Leap 15.5 libmosquitto1-2.0.21-bp156.2.6.1 as a component of openSUSE Leap 15.6 libmosquittopp1-2.0.21-bp156.2.6.1 as a component of openSUSE Leap 15.6 mosquitto-2.0.21-bp156.2.6.1 as a component of openSUSE Leap 15.6 mosquitto-clients-2.0.21-bp156.2.6.1 as a component of openSUSE Leap 15.6 mosquitto-devel-2.0.21-bp156.2.6.1 as a component of openSUSE Leap 15.6 libmosquitto1-2.0.23-bp160.1.1 as a component of openSUSE Leap 16.0 libmosquittopp1-2.0.23-bp160.1.1 as a component of openSUSE Leap 16.0 mosquitto-2.0.23-bp160.1.1 as a component of openSUSE Leap 16.0 mosquitto-clients-2.0.23-bp160.1.1 as a component of openSUSE Leap 16.0 mosquitto-devel-2.0.23-bp160.1.1 as a component of openSUSE Leap 16.0 libmosquitto1-2.0.21-2.1 as a component of openSUSE Tumbleweed libmosquittopp1-2.0.21-2.1 as a component of openSUSE Tumbleweed mosquitto-2.0.21-2.1 as a component of openSUSE Tumbleweed mosquitto-clients-2.0.21-2.1 as a component of openSUSE Tumbleweed mosquitto-devel-2.0.21-2.1 as a component of openSUSE Tumbleweed In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if the remote connection sends a crafted PUBLISH packet to the broker a double free will occur with a subsequent crash of the broker. CVE-2024-3935 SUSE Package Hub 15 SP5:libmosquitto1-2.0.20-bp155.3.3.1 SUSE Package Hub 15 SP5:libmosquittopp1-2.0.20-bp155.3.3.1 SUSE Package Hub 15 SP5:mosquitto-2.0.20-bp155.3.3.1 SUSE Package Hub 15 SP5:mosquitto-clients-2.0.20-bp155.3.3.1 SUSE Package Hub 15 SP5:mosquitto-devel-2.0.20-bp155.3.3.1 SUSE Package Hub 15 SP6:libmosquitto1-2.0.21-bp156.2.6.1 SUSE Package Hub 15 SP6:libmosquittopp1-2.0.21-bp156.2.6.1 SUSE Package Hub 15 SP6:mosquitto-2.0.21-bp156.2.6.1 SUSE Package Hub 15 SP6:mosquitto-clients-2.0.21-bp156.2.6.1 SUSE Package Hub 15 SP6:mosquitto-devel-2.0.21-bp156.2.6.1 openSUSE Leap 15.5:libmosquitto1-2.0.20-bp155.3.3.1 openSUSE Leap 15.5:libmosquittopp1-2.0.20-bp155.3.3.1 openSUSE Leap 15.5:mosquitto-2.0.20-bp155.3.3.1 openSUSE Leap 15.5:mosquitto-clients-2.0.20-bp155.3.3.1 openSUSE Leap 15.5:mosquitto-devel-2.0.20-bp155.3.3.1 openSUSE Leap 15.6:libmosquitto1-2.0.21-bp156.2.6.1 openSUSE Leap 15.6:libmosquittopp1-2.0.21-bp156.2.6.1 openSUSE Leap 15.6:mosquitto-2.0.21-bp156.2.6.1 openSUSE Leap 15.6:mosquitto-clients-2.0.21-bp156.2.6.1 openSUSE Leap 15.6:mosquitto-devel-2.0.21-bp156.2.6.1 openSUSE Leap 16.0:libmosquitto1-2.0.23-bp160.1.1 openSUSE Leap 16.0:libmosquittopp1-2.0.23-bp160.1.1 openSUSE Leap 16.0:mosquitto-2.0.23-bp160.1.1 openSUSE Leap 16.0:mosquitto-clients-2.0.23-bp160.1.1 openSUSE Leap 16.0:mosquitto-devel-2.0.23-bp160.1.1 openSUSE Tumbleweed:libmosquitto1-2.0.21-2.1 openSUSE Tumbleweed:libmosquittopp1-2.0.21-2.1 openSUSE Tumbleweed:mosquitto-2.0.21-2.1 openSUSE Tumbleweed:mosquitto-clients-2.0.21-2.1 openSUSE Tumbleweed:mosquitto-devel-2.0.21-2.1 important 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H