https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-02T04:33:29.732626+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2024-3935 CVE-2024-3935 — Eclipse Mosquito: Double free vulnerability 2026-10-02T04:33:29.734876+00:00

Affected: Eclipse Foundation mosquitto, eclipse_foundation mosquitto

In Eclipse Mosquito, versions from 2.0.0 through 2.0.18, if a Mosquitto broker is configured to create an outgoing bridge connection, and that bridge connection has an incoming topic configured that makes use of topic remapping, then if the remote connection sends a crafted PUBLISH packet to the broker a double free will occur with a subsequent crash of the broker.

 https://vulnerability.circl.lu/vuln/usn-7441-1 USN-7441-1 — mosquitto vulnerabilities 2026-10-02T04:33:29.734969+00:00

Affected: Ubuntu:Pro:14.04:LTS: mosquitto, Ubuntu:Pro:16.04:LTS: mosquitto, Ubuntu:Pro:18.04:LTS: mosquitto, Ubuntu:Pro:20.04:LTS: mosquitto, Ubuntu:22.04:LTS: mosquitto, Ubuntu:Pro:24.04:LTS: mosquitto

It was discovered that Eclipse Mosquitto client incorrectly handled memory when receiving a SUBACK packet. An attacker with a malicious broker could possibly use this issue to execute arbitrary code or cause a denial of service. (CVE-2024-10525)

Xiangpu Song discovered that Eclipse Mosquitto broker did not properly manage memory under certain circumstances. A malicious client with a remote connection could possibly use this issue to cause the broker to crash resulting in a denial of service, or another unspecified impact. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2024-3935)