CVE Feed

    Dashboard / CVE / CVE-2026-101003

    CVE-2026-101003

    A weakness has been identified in Cesanta Mongoose up to 7.21. Affected by this vulnerability is the function fn of the file tutorials/mqtt/mqtt-server/main.c of the component MQTT Broker. Executing a manipulation can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 7.22 addresses this issue. This patch is called a9df523f76f43a38bd53b4232b9cfd4c16869e71. Upgrading the affected component is advised.

    Published:Sep 28, 2026
    Last Modified:Oct 1, 2026
    EPS:Sep 28, 2026
    EPSS Score:0.00462
    CVSS Score:5.3

    Affected Products

    Vendor
    Cesanta
    Product
    Mongoose

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-115473 (CVSS 6.5) — Mongoose is an embedded web server and network library. Prior to 7.22, mg_path_is_sane in src/util.c read path…
    CVE-2026-63626 (CVSS 8.8) — Mongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c tru…
    CVE-2026-73261 (CVSS 7.5) — Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG…
    CVE-2026-73260 (CVSS 7.5) — Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser sel…
    CVE-2026-73252 (CVSS 7.5) — Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MG_T…
    CVE-2026-73253 (CVSS 9.1) — Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker wit…
    CVE-2026-73255 (CVSS 6.5) — Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enab…
    CVE-2026-73259 (CVSS 5.4) — Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted pe…
    CVE-2026-73256 (CVSS 9.1) — Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can e…
    CVE-2026-73254 (CVSS 5.4) — Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High