CVE-2024-3935

What it actually does

Double free memory corruption in the Mosquitto broker when processing a crafted PUBLISH packet over an outgoing bridge connection that uses incoming topic remapping, resulting in immediate process termination.

Why it matters to the business

Broker outage disrupts MQTT message routing for any connected clients and applications, causing loss of IoT or telemetry data flows until manual restart.

How an attack unfolds

An attacker with network access to the remote broker endpoint sends a specially crafted PUBLISH packet that triggers topic remapping on the incoming bridge; the broker's handling path performs two frees on the same allocation, crashing the process.

How to fix it

Upgrade Eclipse Mosquitto to the commit 5eb40ee3d691fb3c2dc222685e7ffcf6e6a69a79 or later releases; for Ubuntu packages apply the listed kernel fixes where Mosquitto is bundled.

How to confirm the fix worked

Confirm the running Mosquitto binary or package version is newer than the vulnerable range; attempt to reproduce the crash with a controlled test packet in a lab environment after upgrade to verify absence of the double-free path.

Typical attack path

1. Identify a Mosquitto broker configured with an outgoing bridge that has incoming topic remapping enabled.
2. Establish a connection to the remote side of the bridge.
3. Transmit a crafted PUBLISH packet targeting the remapped topic.
4. Trigger the double-free condition leading to broker crash and denial of service.

How to detect it

Review Mosquitto daemon logs and system crash dumps for abrupt terminations around the time of unexpected PUBLISH traffic on bridged topics; correlate with bridge connection events and memory-related fault signatures.

• mosquitto process segmentation fault or abort in system logs
• bridge connection with remapping enabled in mosquitto.conf
• unexpected broker restart without configuration change

What your security team should do

• Immediately upgrade all Mosquitto instances to the fixed commit or patched distribution packages.
• Audit bridge configurations and disable topic remapping on outgoing bridges where not strictly required.
• Implement network segmentation so only trusted endpoints can reach bridge connections.
• Monitor broker process health and enable automatic restarts with alerting on unexpected terminations.