CVE-2024-3935: Eclipse Mosquitto Use-After-Free Vulnerability

CVE-2024-3935 Overview

CVE-2024-3935 is a double free vulnerability [CWE-415] in Eclipse Mosquitto, an open-source Message Queuing Telemetry Transport (MQTT) broker. The flaw affects versions 2.0.0 through 2.0.18 when the broker is configured with an outgoing bridge connection that uses topic remapping on incoming topics. A remote peer on the bridged side can send a crafted PUBLISH packet to trigger a double free and crash the broker.

Critical Impact
A crafted MQTT PUBLISH packet sent over a configured bridge with remapped incoming topics causes a double free, resulting in a denial-of-service crash of the Mosquitto broker.

Affected Products

Eclipse Mosquitto 2.0.0 through 2.0.18
Deployments configured with outgoing bridge connections
Bridges with topic remapping on incoming topics

Discovery Timeline

2024-10-30 - CVE-2024-3935 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3935

Vulnerability Analysis

Eclipse Mosquitto supports bridging, where one broker connects to another to exchange messages. Bridge configurations can remap topic names between the local and remote brokers. The vulnerability lives in the bridge topic handling path in src/bridge_topic.c, invoked when an incoming PUBLISH packet arrives on a bridge configured with topic remapping.

When mosquitto_topic_matches_sub() returns an error while comparing the remote topic against a subscription pattern, the code frees the allocated *topic buffer but leaves the caller's pointer dangling. A subsequent code path frees the same pointer again, producing a double free. The result is heap corruption and a broker crash, which disrupts every MQTT client connected to that broker.

Root Cause

The defect is a missing pointer nullification after a free operation. In the pre-patch code, mosquitto__free(*topic) was called on the error path without setting *topic = NULL, so a second free later in the flow operated on the same freed allocation. This is a textbook CWE-415 (Double Free) pattern caused by improper cleanup on an error return.

Attack Vector

Exploitation requires that the target broker already holds a bridge connection to a remote broker and that the bridge is configured with an incoming topic that uses remapping. The attacker must control, compromise, or influence the remote side of that bridge in order to deliver a crafted PUBLISH packet whose topic triggers the failing match path. The attack does not require credentials on the victim broker itself, only that traffic reaches the remapping code through the bridge. Successful exploitation crashes the broker process, denying MQTT service to all downstream clients.

				rc = mosquitto_topic_matches_sub(cur_topic->remote_topic, *topic, &match);
				if(rc){
					mosquitto__free(*topic);
+					*topic = NULL;
					return rc;
				}
				if(match){

Source: Eclipse Mosquitto commit ae7a804. The patch sets *topic = NULL after the free, preventing the caller from re-freeing the same allocation.

Detection Methods for CVE-2024-3935

Indicators of Compromise

Unexpected mosquitto broker process crashes or restarts, especially on hosts running bridge configurations.
Core dumps or SIGABRT / SIGSEGV termination signals from the mosquitto binary correlated with bridge traffic.
Loss of MQTT client sessions and mass reconnection attempts following a broker crash.
Anomalous PUBLISH packets arriving over a bridge with topic strings that do not match expected patterns for remapped topics.

Detection Strategies

Inventory all Mosquitto brokers and confirm which run version 2.0.0 through 2.0.18 with bridge and topic ... in remapping directives in mosquitto.conf.
Monitor broker logs for abrupt termination messages and correlate with recent bridge peer activity.
Capture MQTT traffic on the bridge interface and inspect PUBLISH topics for malformed or unexpected values.

Monitoring Recommendations

Alert on mosquitto service restarts through the host process supervisor (systemd, container runtime).
Track connection churn from MQTT clients as a proxy signal for broker instability.
Log and review bridge peer identities and certificates; treat any untrusted remote as an attack surface.

How to Mitigate CVE-2024-3935

Immediate Actions Required

Upgrade Eclipse Mosquitto to version 2.0.19 or later, which contains commit ae7a804.
On Debian LTS systems, apply the update referenced in the Debian LTS security announcement.
Audit mosquitto.conf for connection, topic ... in, and topic remap patterns to identify exposed brokers.

Patch Information

The fix is included in Mosquitto 2.0.19, announced in the Mosquitto 2.0.19 release notes and tracked in Eclipse GitLab issue #197. The upstream commit ae7a804dadac8f2aaedb24336df8496a9680fda9 sets *topic = NULL after freeing to eliminate the double free.

Workarounds

Remove topic ... in remapping directives from bridge configurations until the broker is patched.
Disable outgoing bridge connections that terminate at untrusted remote brokers.
Restrict bridge peers with mutual TLS and network segmentation so only trusted brokers can deliver PUBLISH packets.

bash

# Verify installed Mosquitto version and locate bridge remap directives
mosquitto -h | head -n 1
grep -nE '^(connection|topic .* in )' /etc/mosquitto/mosquitto.conf /etc/mosquitto/conf.d/*.conf

# Debian/Ubuntu: apply the security update
sudo apt update && sudo apt install --only-upgrade mosquitto
sudo systemctl restart mosquitto