In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if the remote connection sends a crafted PUBLISH packet to the broker a double free will occur with a subsequent crash of the broker.
CVSS Details
- CVSS 4.0 Base Score: 6 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade mosquitto | Feb 21, 2025 | Oct 30, 2024 |
| Suse | — | Upgrade libmosquitto1Upgrade mosquitto-develUpgrade mosquitto-clientsUpgrade libmosquittopp1Upgrade mosquitto | Nov 5, 2024 | Oct 30, 2024 |
| Ubuntu | — | Upgrade libmosquittopp1Upgrade libmosquittopp1 (Ubuntu Pro)Upgrade libmosquittopp0 (Ubuntu Pro)Upgrade mosquitto-clients (Ubuntu Pro)Upgrade mosquitto-clientsUpgrade mosquittoUpgrade python-mosquitto (Ubuntu Pro)Upgrade libmosquitto1Upgrade libmosquitto1 (Ubuntu Pro)Upgrade mosquitto (Ubuntu Pro)Upgrade libmosquitto0 (Ubuntu Pro) | Apr 21, 2025 | Oct 30, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub