CVE-2019-19307

critical · 9.8

An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infinite loop), or possibly cause an out-of-bounds write, by sending a crafted MQTT protocol packet.

9.8

CVSS

41.6%

EPSS (exploit prob.)

99th

EPSS percentile

2019-11-26

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-125CWE-190CWE-787CWE-835

Affected products

Vendor	Product	Affected versions
cesanta	mongoose	6.16

Check a specific version with /api/v1/cve/match.

References

https://github.com/cesanta/mongoose/issues/1055
https://github.com/cesanta/mongoose/issues/1055

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2019-19307