Description
A weakness has been identified in Cesanta Mongoose up to 7.21. Affected by this vulnerability is the function fn of the file tutorials/mqtt/mqtt-server/main.c of the component MQTT Broker. Executing a manipulation can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 7.22 addresses this issue. This patch is called a9df523f76f43a38bd53b4232b9cfd4c16869e71. Upgrading the affected component is advised.
Published: 2026-09-28
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A stack-based buffer overflow exists in the fn function of tutorials/mqtt/mqtt-server/main.c in Cesanta Mongoose. The overflow can be triggered by maliciously crafted MQTT control packets, allowing the attacker to corrupt the call stack and potentially execute arbitrary code. This weakness is indicated as CWE-119, CWE-121, and CWE-787.

Affected Systems

The vulnerability affects all releases of Cesanta Mongoose up to and including 7.21 that include the MQTT Broker component. Upgrading to version 7.22 or later removes the affected code. The product is Mongoose, an embedded networking library used in IoT devices and applications.

Risk and Exploitability

The CVSS score of 6.9 denotes moderate severity. No EPSS score is available, and the vulnerability is not in the CISA KEV catalog. However, public exploit code exists and the attack can be launched remotely over the network, making the.

Generated by OpenCVE AI on September 28, 2026 at 13:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Cesanta Mongoose to version 7.22 or later, which contains the patch commit a9df523f76f43a38bd53b4232b9cfd4c16869e71.
  • If an immediate upgrade is not possible, restrict network access to the MQTT broker service to trusted hosts or place the broker behind a firewall to limit exposure.
  • Apply the official patch commit directly to the vulnerable component if the upstream update cannot be performed, ensuring the fix is applied to the fn function.

Generated by OpenCVE AI on September 28, 2026 at 13:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 28 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-787
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 28 Sep 2026 05:45:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in Cesanta Mongoose up to 7.21. Affected by this vulnerability is the function fn of the file tutorials/mqtt/mqtt-server/main.c of the component MQTT Broker. Executing a manipulation can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 7.22 addresses this issue. This patch is called a9df523f76f43a38bd53b4232b9cfd4c16869e71. Upgrading the affected component is advised.
Title Cesanta Mongoose MQTT Broker main.c fn stack-based overflow
First Time appeared Cesanta
Cesanta mongoose
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:a:cesanta:mongoose:*:*:*:*:*:*:*:*
Vendors & Products Cesanta
Cesanta mongoose
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Cesanta Mongoose
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-01T14:06:48.183Z

Reserved: 2026-09-27T10:29:14.330Z

Link: CVE-2026-101003

cve-icon Vulnrichment

Updated: 2026-10-01T14:06:40.564Z

cve-icon NVD

Status : Deferred

Published: 2026-09-28T06:16:31.310

Modified: 2026-10-01T15:17:20.110

Link: CVE-2026-101003

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-28T05:30:14Z

Links: CVE-2026-101003 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-28T13:30:18Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow

  • CWE-787

    Out-of-bounds Write