CVE-2024-3935

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if the remote connection sends a crafted PUBLISH packet to the broker a double free will occur with a subsequent crash of the broker.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-415

Affected software

No affected versions have been published.

Timeline

Published: Oct 30, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-393507.5A vulnerability regarding authentication bypass by spoofing is found in the RTSP functionality. This allows man-in-the-middle attackers to o CVE-2024-393517.2A vulnerability regarding improper neutralization of special elements used in an OS command ('OS Command Injection') is found in the NTP con CVE-2024-393524.9A vulnerability regarding incorrect authorization is found in the firmware upgrade functionality. This allows remote authenticated users wit CVE-2024-393532.7Mattermost versions 9.5.x <= 9.5.5 and 9.8.0 fail to sanitize the RemoteClusterFrame payloads before audit logging them which allows a high CVE-2024-393547.8If an attacker tricks a valid user into running Delta Electronics DIAScreen with a file containing malicious code, a stack-based buffer over CVE-2024-393556.5Improper handling of physical or environmental conditions in some Intel(R) Processors may allow an authenticated user to enable denial of se CVE-2024-393567.4NULL pointer dereference in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an una CVE-2024-393577.2A stack-based buffer overflow vulnerability exists in the wireless.cgi SetName() functionality of Wavlink AC3000 M33A8.V5030.210505. A speci CVE-2024-393587.2A buffer overflow vulnerability exists in the adm.cgi set_wzap() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTT CVE-2024-393597.2A stack-based buffer overflow vulnerability exists in the wireless.cgi DeleteMac() functionality of Wavlink AC3000 M33A8.V5030.210505. A spe CVE-2024-39364.3The The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin for WordPress is vulnerable to unauthorized modific CVE-2024-393607.2An os command injection vulnerability exists in the nas.cgi remove_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially cra