CVE-2026-101003

Name of the Vulnerable Software and Affected Versions Cesanta Mongoose versions prior to 7.22

Description A stack-based buffer overflow exists in the MQTT Broker component, specifically within the fn() function located in the tutorials/mqtt/mqtt-server/main.c file. This issue allows a remote attacker to execute a manipulation that could lead to a memory corruption. A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than the buffer is allocated to hold.

Recommendations Update to version 7.22. As a temporary mitigation, restrict access to the MQTT Broker component.