Submit #920005: Cesanta Mongoose 7.20 Stack Buffer Overflow

Stack Buffer Overflow in Mongoose MQTT Broker via Malformed SUBSCRIBE Packet

SUMMARY:
A stack buffer overflow vulnerability exists in the Mongoose MQTT broker (v7.20). When processing a malformed MQTT SUBSCRIBE packet with an excessive number of topics, the fn() event handler writes <topic, qos> pairs directly into the fixed-size resp[256] stack array without proper boundary validation. Sending a crafted packet with more than 256 topics causes a stack buffer overflow, triggering stack smashing detection (__stack_chk_fail) and resulting in process termination (SIGABRT). An unauthenticated remote attacker can crash the MQTT broker with a single malformed packet.

AFFECTED COMPONENT:
MQTT Broker tutorial script (mqtt-server/main.c), event handler function fn(), the resp[256] stack buffer.

TECHNICAL DETAILS:
When processing an MQTT SUBSCRIBE message, the handler iterates over requested topic filters using mg_mqtt_next_sub() and writes each topic's negotiated QoS value into the resp[] array:

uint8_t resp[256]; // Fixed-size stack buffer
int num_topics = 0;
while ((pos = mg_mqtt_next_sub(msg, &topic, &qos, pos)) > 0) {
resp[num_topics++] = qos; // NO boundary check on num_topics
}

There is no validation of num_topics against sizeof(resp) before the write. A malicious SUBSCRIBE packet with more than 256 topic entries overflows resp[], corrupting the stack canary. When fn() returns, __stack_chk_fail() detects the corruption and calls abort(), terminating the broker.

ASAN CRASH TRACE:
==7==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x722f13f16220 at pc 0x5d3d36ebc84a bp 0x7ffc34a426d0 sp 0x7ffc34a426c0
WRITE of size 1 at 0x722f13f16220 thread T0
#0 0x5d3d36ebc849 in fn main.c:92
#1 0x5d3d36ec1ac8 in mg_mgr_poll mongoose.c:3510
#2 0x5d3d36eded2c in main main.c:147

Address 0x722f13f16220 is located in stack of thread T0 at offset 544 in frame
#0 0x5d3d36ebbfb3 in fn main.c:59
This frame has 6 object(s):
[48, 49) 'qos' (line 77)
[288, 544) 'resp' (line 77) <== Memory access at offset 544 overflows this variable

IMPACT:
Denial of Service (DoS): An unauthenticated remote attacker can crash the MQTT broker (SIGABRT due to stack guard) by sending a single malformed packet over TCP to port 1883. Stack smashing / memory corruption may also overwrite critical stack frames or local variables.

STEPS TO REPRODUCE:
1. Build Mongoose MQTT broker (mqtt-server/main.c, v7.20) with AddressSanitizer (-fsanitize=address) or default stack protection (-fstack-protector-strong).
2. Run the broker listening on port 1883.
3. Send the crafted PoC payload (poc.raw, attached) over TCP.
4. The broker crashes instantly with SIGABRT.

FIX:
The vendor (Cesanta) has confirmed and fixed this vulnerability on May 19, 2026. The fix adds a boundary check: "if (num_topics >= sizeof(resp)) break;" before writing to resp[].

DISCLOSURE TIMELINE:
2026-05-13: Vulnerability reported to Cesanta [email protected]
2026-05-13: Vendor acknowledged receipt
2026-05-19: Vendor provided patched mongoose.h and mongoose.c for verification
2026-05-20: Reporter confirmed the fix is effective
2026-05-20: Vendor authorized independent CVE assignment; requested publication no earlier than July 1, 2026

DISCOVERER:
Yu Liu, Sun Yat-sen University. This vulnerability was discovered using GMPFuzz, an LLM-driven coverage-based greybox parallel MQTT fuzzer.

• User: nemo2533 (UID 94190)
• Submission: 08/10/2026 08:48 (2 months ago)
• Moderation: 09/27/2026 12:29 (2 months later)
• Status: Accepted
• VulDB entry: 410873 [Cesanta Mongoose up to 7.21 MQTT Broker main.c fn stack-based overflow]
• Points: 17