Vulnerability · Published Sep 28, 2026 · Assigned by VulDB
CVE-2026-101003Cesanta Mongoose MQTT Broker main.c fn stack-based overflow
Medium 5.3
In plain English
A medium-severity stack buffer overflow in Mongoose from Cesanta. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A weakness has been identified in Cesanta Mongoose up to 7.21. Affected by this vulnerability is the function fn of the file tutorials/mqtt/mqtt-server/main.c of the component MQTT Broker. Executing a manipulation can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 7.22 addresses this issue. This patch is called a9df523f76f43a38bd53b4232b9cfd4c16869e71. Upgrading the affected component is advised.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | mongoose | 7.22+ds-1 | DEBIAN-CVE-2026-101003 |
| Ubuntu:26.10 | mongoose | no fix listed | UBUNTU-CVE-2026-101003 |
Affected products (as reported)
Weakness: CWE-121, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
References
- VDB-410873 | Cesanta Mongoose MQTT Broker main.c fn stack-based overflow vdb-entry, technical-description
- VDB-410873 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- CVE-2026-101003 | CVE Analysis and Report third-party-advisory
- Submit #920005 | Cesanta Mongoose 7.20 Stack Buffer Overflow third-party-advisory
- https://github.com/cesanta/mongoose/commit/a9df523f76f43a38bd53b4232b9cfd4c16869e71 patch
- https://github.com/cesanta/mongoose/releases/tag/7.22 patch
- https://github.com/cesanta/mongoose/ product