CVE-2019-12951

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2019-12951
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-12951.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-12951
Downstream
Published
2019-06-24T23:15:12.210Z
Modified
2025-11-20T10:56:32.436336Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

An issue was discovered in Mongoose before 6.15. The parsemqtt() function in mgmqtt.c has a critical heap-based buffer overflow.

References

Affected packages

Git / github.com/cesanta/mongoose

Affected ranges

Type
GIT
Repo
https://github.com/cesanta/mongoose
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b3e0f780c34cea88f057a62213c012aa88fe2deb
Fixed
d5beb7ba3f3767891f3d85945d7d33c1d8596e37

Affected versions

3.*

3.2
3.3
3.4
3.5
3.6
3.7
3.8

4.*

4.0
4.1

5.*

5.0
5.1
5.2
5.3
5.4
5.5
5.5_20140120
5.6

6.*

6.0
6.1
6.10
6.11
6.2
6.3
6.4
6.5
6.6
6.7
6.8
6.9

Database specific

vanir_signatures

[
    {
        "target": {
            "function": "parse_mqtt",
            "file": "src/mg_mqtt.c"
        },
        "digest": {
            "length": 3484.0,
            "function_hash": "198169568359688866823416702201207463449"
        },
        "signature_version": "v1",
        "source": "https://github.com/cesanta/mongoose/commit/b3e0f780c34cea88f057a62213c012aa88fe2deb",
        "deprecated": false,
        "id": "CVE-2019-12951-02b35968",
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "mongoose.c"
        },
        "digest": {
            "line_hashes": [
                "318451959179559600212943761384714751553",
                "203506875419145949752113475847773794541",
                "300124475507211204145507290533671466820",
                "99989783270940607929970042812623215153",
                "113964899949487998914705191903055108661",
                "220909073243904259200325940333054122391",
                "181963326070752889268247635560144729332",
                "194616825067426885033132069526593454473",
                "32297059813226418094209480233904743941",
                "158743914063726245224935765878676000180",
                "242058701329965836886413194556142218028",
                "202685874918949681063835384083901977148",
                "298896519032976953735511227272721233568",
                "234203154594107864103826915773165607850",
                "156914595055367849120805501920246572284",
                "316546846396089965587538649279488520373",
                "115818615017429595644330698564950237276",
                "212090324586127216818259759998632085017",
                "280321884277974389504920536560302828502"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "source": "https://github.com/cesanta/mongoose/commit/b3e0f780c34cea88f057a62213c012aa88fe2deb",
        "deprecated": false,
        "id": "CVE-2019-12951-a154c9ac",
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "parse_mqtt",
            "file": "mongoose.c"
        },
        "digest": {
            "length": 3484.0,
            "function_hash": "198169568359688866823416702201207463449"
        },
        "signature_version": "v1",
        "source": "https://github.com/cesanta/mongoose/commit/b3e0f780c34cea88f057a62213c012aa88fe2deb",
        "deprecated": false,
        "id": "CVE-2019-12951-b0b505de",
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "src/mg_mqtt.c"
        },
        "digest": {
            "line_hashes": [
                "318451959179559600212943761384714751553",
                "203506875419145949752113475847773794541",
                "300124475507211204145507290533671466820",
                "99989783270940607929970042812623215153",
                "113964899949487998914705191903055108661",
                "220909073243904259200325940333054122391",
                "181963326070752889268247635560144729332",
                "194616825067426885033132069526593454473",
                "32297059813226418094209480233904743941",
                "158743914063726245224935765878676000180",
                "242058701329965836886413194556142218028",
                "202685874918949681063835384083901977148",
                "298896519032976953735511227272721233568",
                "234203154594107864103826915773165607850",
                "156914595055367849120805501920246572284",
                "316546846396089965587538649279488520373",
                "115818615017429595644330698564950237276",
                "212090324586127216818259759998632085017",
                "280321884277974389504920536560302828502"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "source": "https://github.com/cesanta/mongoose/commit/b3e0f780c34cea88f057a62213c012aa88fe2deb",
        "deprecated": false,
        "id": "CVE-2019-12951-b1da9acb",
        "signature_type": "Line"
    }
]