CVE-2023-2905CWE-122

Cesanta Mongoose MQTT Message Parsing Heap Overflow

published August 9, 2023

CVSS
—
EPSS
1%
Percentile
62.7
In the wild
Unconfirmed
What it is

Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web server, version 7.10 is susceptible to a heap-based buffer overflow vulnerability in the default configuration. Version 7.9 and prior does not appear to be vulnerable. This issue is resolved in version 7.11.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01006 · 62.7th percentile
Weakness
CWE-122 · Heap-based Buffer Overflow
Published
2023-08-09T04:46Z
EPSS history
Timeline
  • 09 AUG 04:46Z
    Cesanta Mongoose MQTT Message Parsing Heap Overflow
    cvelistv5