CVE-2025-65502
Null pointer dereference in add_ca_certs() in Cesanta Mongoose before 7.2 allows remote attackers...
Null pointer dereference in add_ca_certs() in Cesanta Mongoose before 7.2 allows remote attackers to cause a denial of service via TLS initialization where SSL_CTX_get_cert_store() returns NULL.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Null pointer dereference in add_ca_certs() in Cesanta Mongoose before 7.2 allows remote attackers to cause a denial of service via TLS initialization where SSL_CTX_get_cert_store() returns NULL.
- Record
CVE-2025-65502- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Weakness
- CWE-476
- Updated
- 2026-11-02
EUVDEUVD-2025-198709
Null pointer dereference in add_ca_certs() in Cesanta Mongoose before 7.2 allows remote attackers to cause a denial of service via TLS initialization where SSL_CTX_get_cert_store() returns NULL.
- Record
EUVD-2025-198709- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hp7w-j9mx-8vpj
Null pointer dereference in add_ca_certs() in Cesanta Mongoose before 7.2 allows remote attackers...
Null pointer dereference in add_ca_certs() in Cesanta Mongoose before 7.2 allows remote attackers to cause a denial of service via TLS initialization where SSL_CTX_get_cert_store() returns NULL.
- Record
GHSA-hp7w-j9mx-8vpj- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Weakness
- CWE-476
- Updated
- 2026-11-02
NVD
Null pointer dereference in add_ca_certs() in Cesanta Mongoose before 7.2 allows remote attackers to cause a denial of service via TLS initialization where SSL_CTX_get_cert_store() returns NULL.
- Record
CVE-2025-65502- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Weakness
- CWE-476
- Updated
- 2026-11-05
OSV
Null pointer dereference in add_ca_certs() in Cesanta Mongoose before 7.2 allows remote attackers to cause a denial of service via TLS initialization where SSL_CTX_get_cert_store() returns NULL.
- Record
CVE-2025-65502- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-07
OSVDEBIAN-CVE-2025-65502
Null pointer dereference in add_ca_certs() in Cesanta Mongoose before 7.2 allows remote attackers to cause a denial of service via TLS initialization where SSL_CTX_get_cert_store() returns NULL.
- Record
DEBIAN-CVE-2025-65502- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-06
OSVUBUNTU-CVE-2025-65502
Null pointer dereference in add_ca_certs() in Cesanta Mongoose before 7.2 allows remote attackers to cause a denial of service via TLS initialization where SSL_CTX_get_cert_store() returns NULL.
- Record
UBUNTU-CVE-2025-65502- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
swupdateDebian:12 |
All versions, plus listed versions 2022.12+dfsg-42022.12+dfsg-4+deb12u12022.12+dfsg-4+deb12u1~bpo11+12022.12+dfsg-4+deb12u22022.12+dfsg-4+deb12u3 Show 45 moreShow less2023.05+dfsg-12023.05+dfsg-22023.05+dfsg-2~bpo12+12023.05+dfsg-32023.05+dfsg-42023.05+dfsg-52023.05+dfsg-5~bpo12+12023.12+dfsg-12023.12+dfsg-1~bpo12+12023.12.1+dfsg-12023.12.1+dfsg-1~bpo12+12023.12.1+dfsg-22023.12.1+dfsg-2~bpo12+12024.05+dfsg-12024.05.2+dfsg-12024.05.2+dfsg-22024.05.2+dfsg-2~bpo12+12024.12+dfsg-12024.12+dfsg-22024.12+dfsg-2~bpo12+12024.12.1+dfsg-12024.12.1+dfsg-1~bpo12+12024.12.1+dfsg-22024.12.1+dfsg-32024.12.1+dfsg-3~bpo12+12025.05+dfsg-12025.05+dfsg-22025.05+dfsg-2~bpo13+12025.05+dfsg-32025.05+dfsg-3~bpo13+12025.12+dfsg-12025.12+dfsg-102025.12+dfsg-10~bpo13+12025.12+dfsg-10~bpo13+22025.12+dfsg-22025.12+dfsg-2~bpo13+12025.12+dfsg-32025.12+dfsg-42025.12+dfsg-52025.12+dfsg-62025.12+dfsg-72025.12+dfsg-7~bpo13+12025.12+dfsg-82025.12+dfsg-92026.05+dfsg-1 |
None known |
swupdateDebian:13 |
All versions, plus listed versions 2024.12.1+dfsg-32024.12.1+dfsg-3+deb13u12024.12.1+dfsg-3+deb13u22025.05+dfsg-12025.05+dfsg-2 Show 27 moreShow less2025.05+dfsg-2~bpo13+12025.05+dfsg-32025.05+dfsg-3~bpo13+12025.12+dfsg-12025.12+dfsg-102025.12+dfsg-10~bpo13+12025.12+dfsg-10~bpo13+22025.12+dfsg-22025.12+dfsg-2~bpo13+12025.12+dfsg-32025.12+dfsg-42025.12+dfsg-52025.12+dfsg-62025.12+dfsg-72025.12+dfsg-7~bpo13+12025.12+dfsg-82025.12+dfsg-92026.05+dfsg-12026.05+dfsg-22026.05+dfsg-32026.05+dfsg-3~bpo13+12026.05+dfsg-42026.05.1+dfsg-12026.05.1+dfsg-1~bpo13+12026.05.1+git20261001+dfsg-12026.05.1+git20261001+dfsg-22026.05.1+git20261001+dfsg-2~bpo13+1 |
None known |
swupdateDebian:14 |
before 2025.12+dfsg-1, plus listed versions 2024.12.1+dfsg-32025.05+dfsg-12025.05+dfsg-22025.05+dfsg-2~bpo13+12025.05+dfsg-32025.05+dfsg-3~bpo13+1 |
2025.12+dfsg-1 |
swupdateUbuntu:22.04:LTS |
All versions, plus listed versions 2020.11-22021.04-1.12021.04-22021.04-2build12021.11-1 |
None known |
swupdateUbuntu:24.04:LTS |
All versions, plus listed versions 2023.05+dfsg-32023.05+dfsg-42023.05+dfsg-4build12023.05+dfsg-52023.12+dfsg-12023.12.1+dfsg-1ubuntu12023.12.1+dfsg-1ubuntu42023.12.1+dfsg-1ubuntu5 |
None known |
swupdateUbuntu:25.10 |
All versions, plus listed versions 2024.12.1+dfsg-1build22024.12.1+dfsg-22024.12.1+dfsg-32025.05+dfsg-2ubuntu1 |
None known |
mongooseUbuntu:26.10 |
All versions, plus listed versions 7.21+ds-17.21+ds-27.22+ds-17.23+ds-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| facts | NVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-65502 is a medium vulnerability (CVSS 4.3) in Cesanta Mongoose, published November 24, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 23rd percentile. Fixed in swupdate 2025.12+dfsg-1.
References
github.com/cesanta/mongoose/issues/3306
nvd.nist.gov/vuln/detail/CVE-2025-65502
security-tracker.debian.org/tracker/CVE-2025-65502
ubuntu.com/security/CVE-2025-65502
cve.org/CVERecord?id=CVE-2025-65502
Left out here: 9 versions. The JSON record has them.