high8.8
CVE-2023-2905
Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web serv…
Impact
Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web server, version 7.10 is susceptible to a heap-based buffer overflow vulnerability in the default configuration. Version 7.9 and prior does not appear to be vulnerable. This issue is resolved in version 7.11.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cesanta | Mongoose | Version 7.10 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/cesanta/mongoose/pull/2274
- https://github.com/cesanta/mongoose/releases/tag/7.11
- https://takeonme.org/cves/CVE-2023-2905.html
- https://github.com/cesanta/mongoose/pull/2274
- https://github.com/cesanta/mongoose/releases/tag/7.11
- https://takeonme.org/cves/CVE-2023-2905.html