CVE-2026-101003: Cesanta Mongoose MQTT Broker main.c fn stack-based overflow
A weakness has been identified in Cesanta Mongoose up to 7.21. Affected by this vulnerability is the function fn of the file tutorials/mqtt/mqtt-server/main.c of the component MQTT Broker. Executing a manipulation can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 7.22 addresses this issue. This patch is called a9df523f76f43a38bd53b4232b9cfd4c16869e71. Upgrading the affected component is advised.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cesanta Mongoose MQTT Brokerto a version that resolves this vulnerability.Fixed in 7.22Patch a9df523f76f43a38bd53b4232b9cfd4c16869e71
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the MQTT Broker tutorial component in tutorials/mqtt/mqtt-server/main.c are affected when running Cesanta Mongoose through version 7.21. The issue is remotely reachable.
Does exploitation require authentication or user interaction?
No privileges or user interaction are required according to the supplied vector. The attack complexity is rated low and a public exploit is available.
What is the remediation?
Upgrade Cesanta Mongoose to version 7.22 or later. The supplied fix is commit a9df523f76f43a38bd53b4232b9cfd4c16869e71.