CVE-2024-42392
Improper Neutralization of Delimiters in Mongoose Web Server library
Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an infinite loop bug if the input string contains unexpected characters.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Improper Neutralization of Delimiters in Mongoose Web Server library
Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an infinite loop bug if the input string contains unexpected characters.
- Record
CVE-2024-42392- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-140
- Updated
- 2026-11-02
EUVDEUVD-2024-39596
Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an infinite loop bug if the input string contains unexpected characters.
- Record
EUVD-2024-39596- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xqwp-cfr5-f9gr
Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows...
Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an infinite loop bug if the input string contains unexpected characters.
- Record
GHSA-xqwp-cfr5-f9gr- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-140
- Updated
- 2026-11-02
NVD
Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an infinite loop bug if the input string contains unexpected characters.
- Record
CVE-2024-42392- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-140
- Updated
- 2026-11-02
OSV
Improper Neutralization of Delimiters in Mongoose Web Server library
Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an infinite loop bug if the input string contains unexpected characters.
- Record
CVE-2024-42392- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-140
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-42392 is a medium vulnerability (CVSS 4.0) in Cesanta Mongoose, published November 18, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. No source names a fixed version.
References
nozominetworks.com/labs/vulnerability-advisories-cve-2024-42392
cert-portal.siemens.com/productcert/html/ssa-142885.html
nvd.nist.gov/vuln/detail/CVE-2024-42392
github.com/advisories/GHSA-xqwp-cfr5-f9gr