CVE-2023-2905: Cesanta Mongoose MQTT Message Parsing Heap Overflow

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-08-09 · updated 2026-06-17
Weakness: CWE-122

Description

Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web server, version 7.10 is susceptible to a heap-based buffer overflow vulnerability in the default configuration. Version 7.9 and prior does not appear to be vulnerable. This issue is resolved in version 7.11.

Affected products

Cesanta Mongoose: 7.10

References

https://github.com/cesanta/mongoose/pull/2274
https://github.com/cesanta/mongoose/releases/tag/7.11
https://takeonme.org/cves/CVE-2023-2905.html
https://github.com/cesanta/mongoose/pull/2274
https://github.com/cesanta/mongoose/releases/tag/7.11
https://takeonme.org/cves/CVE-2023-2905.html

Get alerted when CVE-2023-2905 or the next vulnerability affects your stack