Read the docs
TI-2026-65050 Aliases CVE-2026-101003GHSA-g7gm-388f-77vf

Cesanta Mongoose MQTT Broker main.c fn stack-based overflow

Priority LOW 37CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A weakness has been identified in Cesanta Mongoose up to 7.21. Affected by this vulnerability is the function fn of the file tutorials/mqtt/mqtt-server/main.c of the component MQTT Broker. Executing a manipulation can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 7.22 addresses this issue. This patch is called a9df523f76f43a38bd53b4232b9cfd4c16869e71. Upgrading the affected component is advised.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00462 40th percentileScored 2026-11-07
Fix Fixed Mongoose (Cesanta): 7.22

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CesantaMongoose7.0; 7.1; 7.2; 7.3; 7.4; 7.5; 7.6; 7.7; 7.8; 7.9; 7.10; 7.11; 7.12; 7.13; 7.14; 7.15; 7.16; 7.17; 7.18; 7.19; 7.20; 7.217.22Patch availableCNA
  • Mongoose VendorCesanta Affected 7.0; 7.1; 7.2; 7.3; 7.4; 7.5; 7.6; 7.7; 7.8; 7.9; 7.10; 7.11; 7.12; 7.13; 7.14; 7.15; 7.16; 7.17; 7.18; 7.19; 7.20; 7.21 Fixed in 7.22 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:cesanta:mongoose:*:*:*:*:*:*:*:*——Cesanta
  • cpe:2.3:a:cesanta:mongoose:*:*:*:*:*:*:*:* Versions — — ·Cesanta

Remediation

  • Fix · CNA Mongoose (Cesanta) Fixed in 7.22

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-101003
  2. 2026-10-03 Alias added: GHSA-g7gm-388f-77vf

References

Patch 2

Other 1

  • TI-2023-23198 Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability… CVSS 3.1CRITICAL 9.8
  • TI-2026-51393 Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling CVSS 3.1CRITICAL 9.1
  • TI-2018-15418 Mongoose Web Server 6.9 Denial of Service via Socket Connection CVSS 4.0HIGH 8.7
  • TI-2026-51389 Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching CVSS 4.0CRITICAL 9.1
  • TI-2023-02723 Cesanta Mongoose MQTT Message Parsing Heap Overflow CVSS 3.1HIGH 8.8
  • TI-2020-15865 Buffer overflow in mg_resolve_from_hosts_file in Mongoose 6.18, when reading from a crafted hosts file. CVSS 3.1HIGH 8.8
See all 154 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences