CVE-2026-101003
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
A weakness was identified in Cesanta Mongoose up to 7.21, affecting the fn function in tutorials/mqtt/mqtt-server/main.c (MQTT Broker component). Manipulation leads to a stack-based buffer overflow. The attack can be launched remotely and the exploit is publicly available. Upgrading to version 7.22 (patch a9df523f76f43a38bd53b4232b9cfd4c16869e71) addresses the issue.
Risk Assessment
A remote attacker can trigger a stack-based buffer overflow, potentially leading to arbitrary code execution or service crash. The public availability of the exploit increases the risk of rapid exploitation.
Recommendation
Update Cesanta Mongoose to version 7.22 or later. If updating is not possible, restrict access to the MQTT broker to trusted networks.
Other vulnerabilities in Cesanta Mongoose
See all- CVE-2017-2909High
An infinite loop programming error exists in the DNS server functionality of Cesanta Mongoose 6.8 library. A specially crafted DNS request can cause an infinite loop resulting in high CPU usage and Denial Of Service.
- CVE-2017-2895High
CVE-2017-2895 describes an exploitable arbitrary memory read vulnerability in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can lead to information disclosure and denial of service.
- CVE-2017-2893High
A NULL pointer dereference vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8, which can lead to server crashes. Sending a specially crafted MQTT SUBSCRIBE packet by an attacker can trigger this vulnerability.
- CVE-2017-2922Critical
CVE-2017-2922 describes a memory corruption vulnerability in the Websocket protocol implementation of Cesanta Mongoose 6.8. A specially crafted websocket packet can lead to a buffer being allocated with stale pointers, resulting in a use-after-free vulnerability that can be exploited for remote code execution.
- CVE-2017-2921Critical
CVE-2017-2921 describes a vulnerability in the Websocket protocol implementation of Cesanta Mongoose 6.8 that can lead to heap buffer overflow. A specially crafted websocket packet can cause an integer overflow, resulting in denial of service and potential remote code execution.
- CVE-2017-2894Critical
CVE-2017-2894 describes a stack buffer overflow vulnerability in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause a buffer overflow, leading to remote code execution.
- CVE-2017-2892Critical
An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT packet can cause an arbitrary out-of-bounds memory read and write potentially resulting in information disclosure, denial of service and remote code execution.
- CVE-2017-2891Critical
CVE-2017-2891 describes a use-after-free vulnerability in the HTTP server implementation of Cesanta Mongoose 6.8. An ordinary HTTP POST request with a CGI target can cause a reuse of previously freed pointer, potentially leading to remote code execution.
- CVE-2026-11404High
Cesanta Mongoose before version 7.22 has an out-of-bounds read vulnerability in the mg_tls_server_recv_hello() function. An attacker can send a crafted ClientHello with an oversized session ID length, causing a read past the buffer and crashing HTTPS, MQTTS, or WSS services.
Original NVD description (English source)
A weakness has been identified in Cesanta Mongoose up to 7.21. Affected by this vulnerability is the function fn of the file tutorials/mqtt/mqtt-server/main.c of the component MQTT Broker. Executing a manipulation can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 7.22 addresses this issue. This patch is called a9df523f76f43a38bd53b4232b9cfd4c16869e71. Upgrading the affected component is advised.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS