CVE-2023-2905

Name of the Vulnerable Software and Affected Versions Cesanta Mongoose version 7.10

Description The issue arises from a failure to validate the length of a provided MQTT CMD PUBLISH parsed message with a variable length header, leading to a heap-based buffer overflow vulnerability in the default configuration.

Recommendations For version 7.10, update to version 7.11 to resolve the issue. As a temporary workaround, consider restricting the use of the MQTT CMD PUBLISH message with a variable length header until a patch is available.