CVE-2024-42385
Improper Neutralization of Delimiters in Mongoose Web Server library
Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an out-of-bound memory write if the PEM certificate contains unexpected characters.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Improper Neutralization of Delimiters in Mongoose Web Server library
Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an out-of-bound memory write if the PEM certificate contains unexpected characters.
- Record
CVE-2024-42385- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-140
- Updated
- 2026-11-02
EUVDEUVD-2024-39589
Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an out-of-bound memory write if the PEM certificate contains unexpected characters.
- Record
EUVD-2024-39589- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fj5v-9mxj-77qc
Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows...
Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an out-of-bound memory write if the PEM certificate contains unexpected characters.
- Record
GHSA-fj5v-9mxj-77qc- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-140
- Updated
- 2026-11-02
NVD
Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an out-of-bound memory write if the PEM certificate contains unexpected characters.
- Record
CVE-2024-42385- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H - CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-140
- Updated
- 2026-11-02
OSV
Improper Neutralization of Delimiters in Mongoose Web Server library
Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an out-of-bound memory write if the PEM certificate contains unexpected characters.
- Record
CVE-2024-42385- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-140
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-42385 is a medium vulnerability (CVSS 4.0) in Cesanta Mongoose, published November 18, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.10%, the 0th percentile. No source names a fixed version.
References
nozominetworks.com/labs/vulnerability-advisories-cve-2024-42385
cert-portal.siemens.com/productcert/html/ssa-142885.html
nvd.nist.gov/vuln/detail/CVE-2024-42385
github.com/advisories/GHSA-fj5v-9mxj-77qc