Cesanta Mongoose CVE-2026-101003

Requires a reachable network service running the Cesanta Mongoose MQTT broker TUTORIAL example (tutorials/mqtt/mqtt-server/main.c) at version 7.21 or earlier; the attacker sends a manipulated MQTT message to trigger the stack overflow in the fn handler. No authentication or user interaction is required per the CVSS vector (PR:N/UI:N). The dominant LIMITING factor is that this is example/tutorial code, not the core library - production systems that embed Mongoose but do not build and expose this specific tutorial broker are not affected. Impact is confined to denial of service (VA:L); no code execution or data disclosure is indicated.

This is a high-CVSS-number-but-low-real-risk issue. The vendor CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) scores 6.9 largely because the remote, unauthenticated attack surface inflates the base score, but the impact metrics tell the real story: VC:N/VI:N/VA:L means NO confidentiality or integrity impact and only LOW availability impact - a denial-of-service class flaw, not code execution, despite the CWE-121 stack-overflow classification. SSVC-style signals: exploitation is proof-of-concept only (E:P, POC exists per VulDB) - NOT active exploitation; there is no CISA KEV listing and no EPSS score provided, so widespread automated exploitation is not evidenced. Two critical caveats reduce priority further: (1) the vulnerable code is in tutorials/mqtt/mqtt-server/main.c - an EXAMPLE/tutorial MQTT broker, not the core Mongoose library - so almost no production deployment runs this code verbatim; and (2) the referenced patch commit diff (a9df523f) touches core mongoose.c (DNS, mg_dtoa, filesystem, HTTP Content-Length/Transfer-Encoding smuggling, HTML escaping) but does NOT visibly modify the named tutorial file, indicating the commit is a release-bundle and the patch-to-description mapping is inconsistent - verify the actual fix with the vendor. Net: low real-world priority.

An attacker with network reachability to a host running the Mongoose MQTT server tutorial example sends a crafted MQTT message that overflows a stack buffer in the connection handler function fn, crashing the process (denial of service). A public proof-of-concept exists (VulDB), but the impact is availability-only and the affected code is example/tutorial code rather than the deployed core library.