CVE-2023-2905— Cesanta Mongoose MQTT Message Parsing Heap Overflow
Quick assessment
Affected
Cesanta Mongoose
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Cesanta Mongoose是爱尔兰Cesanta公司的一套嵌入式服务器库，它包括TCP、HTTP客户端和服务器、WenSocket客户端和服务器等功能。 Cesanta Mongoose 7.11 版本存在安全漏洞，该漏洞源于没有验证带有可变长度标头的 MQTT_CMD_PUBLISH 解析消息的长度。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-2905
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cesanta Mongoose MQTT Message Parsing Heap Overflow
Source: CVE Program / CVE List V5
Vulnerability Description
Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web server, version 7.10 is susceptible to a heap-based buffer overflow vulnerability in the default configuration. Version 7.9 and prior does not appear to be vulnerable. This issue is resolved in version 7.11.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
堆缓冲区溢出
Source: CVE Program / CVE List V5
Vulnerability Title
Cesanta Mongoose 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cesanta Mongoose是爱尔兰Cesanta公司的一套嵌入式服务器库，它包括TCP、HTTP客户端和服务器、WenSocket客户端和服务器等功能。 Cesanta Mongoose 7.11 版本存在安全漏洞，该漏洞源于没有验证带有可变长度标头的 MQTT_CMD_PUBLISH 解析消息的长度。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2023-2905
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-2905
请登录查看更多情报信息。
Patches & Fixes for CVE-2023-2905 (1)
Other References for CVE-2023-2905 (1)
Other References for CVE-2023-2905 (1)
-
https://github.com/cesanta/mongoose/releases/tag/7.11 release-notes
IV. Related Vulnerabilities
Same product: Mongoose
-
CVE-2026-101003
Cesanta Mongoose MQTT Broker main.c fn stack-based overflow -
CVE-2026-73253
Mongoose: TLS Hostname Verification Bypass via Overly Permis -
CVE-2026-73255
Mongoose: Path traversal in SSI #include directives enables -
CVE-2026-73259
Mongoose: Reflected XSS via decoded URI in directory listing -
CVE-2026-73256
Mongoose: HTTP/1.0 detection off-by-one enables request smug
Same vendor: Cesanta
-
CVE-2026-101003
Cesanta Mongoose MQTT Broker main.c fn stack-based overflow -
CVE-2026-86716
Cesanta mJS mjs_tok.c skip_spaces_and_comments heap-based ov -
CVE-2026-73253
Mongoose: TLS Hostname Verification Bypass via Overly Permis -
CVE-2026-73255
Mongoose: Path traversal in SSI #include directives enables -
CVE-2026-73259
Mongoose: Reflected XSS via decoded URI in directory listing
Same weakness: CWE-122
-
CVE-2026-105842
lrzsz before 0.13.0 Heap Buffer Overflow via lrz procheader( -
CVE-2026-75818
Heap Buffer Overflow in GNU Aspell's prezip utility -
CVE-2026-103631
Chrome <154.0.8037.97 WebRTC堆溢出漏洞 -
CVE-2026-91135
Apache Thrift: C++ `THeaderTransport::transform()` heap buff -
CVE-2026-14316
Heap buffer overflow in boks_sshd revoked-key error handling
V. Comments for CVE-2023-2905
No comments yet