CVE-2017-2895

🗓️ 07 Nov 2017 16:00:00Reported by talosType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 61 Views🌐 WEB

An arbitrary memory read vulnerability in Mongoose 6.8 allows information disclosure

Reporter	Title	Published	Views	Family All 14
CNVD	Cesanta Mongoose MQTT Information Disclosure Vulnerability	2 Nov 201700:00	–	cnvd
Cvelist	CVE-2017-2895	7 Nov 201716:00	–	cvelist
Debian CVE	CVE-2017-2895	7 Nov 201716:00	–	debiancve
EUVD	EUVD-2017-12036	7 Oct 202500:30	–	euvd
NVD	CVE-2017-2895	7 Nov 201716:29	–	nvd
OpenVAS	Mongoose Web Server <= 6.8 Multiple Vulnerabilities	7 Jul 202100:00	–	openvas
OSV	DEBIAN-CVE-2017-2895	7 Nov 201716:29	–	osv
Prion	Information disclosure	7 Nov 201716:29	–	prion
RedhatCVE	CVE-2017-2893	20 May 202223:50	–	redhatcve
RedhatCVE	CVE-2017-2921	20 May 202223:55	–	redhatcve

NVD

Vulners

Node

cesanta mongooseMatch6.8

[
  {
    "product": "Mongoose",
    "vendor": "Cesanta",
    "versions": [
      {
        "status": "affected",
        "version": "6.8"
      }
    ]
  }
]

Source	Link
talosintelligence	www.talosintelligence.com/vulnerability_reports/TALOS-2017-0402

Parameter	Position	Path	Description	CWE
topic length in SUBSCRIBE packet	binary	examples/mqtt_broker/mqtt_broker	Arbitrary memory read via unsafe topic length handling during MQTT SUBSCRIBE parsing (mg_mqtt_next_subscribe_topic) can read out-of-bounds memory, potentially leaking information.	CWE-125
qos byte	binary	examples/mqtt_broker/mqtt_broker	Arbitrary memory read via unsafe topic length handling during MQTT SUBSCRIBE parsing (mg_mqtt_next_subscribe_topic) can read out-of-bounds memory, potentially leaking information.	CWE-125
subscribe topic string	binary	examples/mqtt_broker/mqtt_broker	Arbitrary memory read via unsafe topic length handling during MQTT SUBSCRIBE parsing (mg_mqtt_next_subscribe_topic) can read out-of-bounds memory, potentially leaking information.	CWE-125

13 May 2026 00:24Current

7.7High risk

Vulners AI Score7.7

CVSS 26.4

CVSS 3.18.2

CVSS 38.2

EPSS0.00376

CWE-125