CVE-2026-5244
Cesanta Mongoose TLS 1.3 mongoose.c mg_tls_recv_cert heap-based overflow
A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mongoose.c of the component TLS 1.3 Handler. Such manipulation of the argument pubkey leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.21 mitigates this issue. The name of the patch is 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Cesanta Mongoose TLS 1.3 mongoose.c mg_tls_recv_cert heap-based overflow
A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mongoose.c of the component TLS 1.3 Handler. Such manipulation of the argument pubkey leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.21 mitigates this issue. The name of the patch is 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Record
CVE-2026-5244- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C - CVSS 3.0
- 7.3 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C - CVSS 2.0
- 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C - Weakness
- CWE-122, CWE-119
- Updated
- 2026-11-02
EUVDEUVD-2026-18170
A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mongoose.c of the component TLS 1.3 Handler. Such manipulation of the argument pubkey leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.21 mitigates this issue. The name of the patch is 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Record
EUVD-2026-18170- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7vfw-f3r2-9m2j
A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function...
A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mongoose.c of the component TLS 1.3 Handler. Such manipulation of the argument pubkey leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.21 mitigates this issue. The name of the patch is 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Record
GHSA-7vfw-f3r2-9m2j- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-119
- Updated
- 2026-11-02
NVD
A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mongoose.c of the component TLS 1.3 Handler. Such manipulation of the argument pubkey leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.21 mitigates this issue. The name of the patch is 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Record
CVE-2026-5244- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119, CWE-122
- Updated
- 2026-11-02
OSV
Cesanta Mongoose TLS 1.3 mongoose.c mg_tls_recv_cert heap-based overflow
A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mongoose.c of the component TLS 1.3 Handler. Such manipulation of the argument pubkey leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.21 mitigates this issue. The name of the patch is 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Record
CVE-2026-5244- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P - Weakness
- CWE-119, CWE-122
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-5244
A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mongoose.c of the component TLS 1.3 Handler. Such manipulation of the argument pubkey leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.21 mitigates this issue. The name of the patch is 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Record
DEBIAN-CVE-2026-5244- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVJLSEC-2026-369
A vulnerability has been found in Cesanta Mongoose up to 7.20
A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mongoose.c of the component TLS 1.3 Handler. Such manipulation of the argument pubkey leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.21 mitigates this issue. The name of the patch is 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Record
JLSEC-2026-369- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-5244
A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mongoose.c of the component TLS 1.3 Handler. Such manipulation of the argument pubkey leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.21 mitigates this issue. The name of the patch is 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
- Record
UBUNTU-CVE-2026-5244- CVSS 4.0
- 5.5 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
swupdateDebian:12 |
All versions, plus listed versions 2022.12+dfsg-42022.12+dfsg-4+deb12u12022.12+dfsg-4+deb12u1~bpo11+12022.12+dfsg-4+deb12u22022.12+dfsg-4+deb12u3 Show 45 moreShow less2023.05+dfsg-12023.05+dfsg-22023.05+dfsg-2~bpo12+12023.05+dfsg-32023.05+dfsg-42023.05+dfsg-52023.05+dfsg-5~bpo12+12023.12+dfsg-12023.12+dfsg-1~bpo12+12023.12.1+dfsg-12023.12.1+dfsg-1~bpo12+12023.12.1+dfsg-22023.12.1+dfsg-2~bpo12+12024.05+dfsg-12024.05.2+dfsg-12024.05.2+dfsg-22024.05.2+dfsg-2~bpo12+12024.12+dfsg-12024.12+dfsg-22024.12+dfsg-2~bpo12+12024.12.1+dfsg-12024.12.1+dfsg-1~bpo12+12024.12.1+dfsg-22024.12.1+dfsg-32024.12.1+dfsg-3~bpo12+12025.05+dfsg-12025.05+dfsg-22025.05+dfsg-2~bpo13+12025.05+dfsg-32025.05+dfsg-3~bpo13+12025.12+dfsg-12025.12+dfsg-102025.12+dfsg-10~bpo13+12025.12+dfsg-10~bpo13+22025.12+dfsg-22025.12+dfsg-2~bpo13+12025.12+dfsg-32025.12+dfsg-42025.12+dfsg-52025.12+dfsg-62025.12+dfsg-72025.12+dfsg-7~bpo13+12025.12+dfsg-82025.12+dfsg-92026.05+dfsg-1 |
None known |
swupdateDebian:13 |
All versions, plus listed versions 2024.12.1+dfsg-32024.12.1+dfsg-3+deb13u12024.12.1+dfsg-3+deb13u22025.05+dfsg-12025.05+dfsg-2 Show 27 moreShow less2025.05+dfsg-2~bpo13+12025.05+dfsg-32025.05+dfsg-3~bpo13+12025.12+dfsg-12025.12+dfsg-102025.12+dfsg-10~bpo13+12025.12+dfsg-10~bpo13+22025.12+dfsg-22025.12+dfsg-2~bpo13+12025.12+dfsg-32025.12+dfsg-42025.12+dfsg-52025.12+dfsg-62025.12+dfsg-72025.12+dfsg-7~bpo13+12025.12+dfsg-82025.12+dfsg-92026.05+dfsg-12026.05+dfsg-22026.05+dfsg-32026.05+dfsg-3~bpo13+12026.05+dfsg-42026.05.1+dfsg-12026.05.1+dfsg-1~bpo13+12026.05.1+git20261001+dfsg-12026.05.1+git20261001+dfsg-22026.05.1+git20261001+dfsg-2~bpo13+1 |
None known |
swupdateDebian:14 |
before 2025.12+dfsg-10, plus listed versions 2024.12.1+dfsg-32025.05+dfsg-12025.05+dfsg-22025.05+dfsg-2~bpo13+12025.05+dfsg-3 Show 14 moreShow less2025.05+dfsg-3~bpo13+12025.12+dfsg-12025.12+dfsg-10~bpo13+12025.12+dfsg-10~bpo13+22025.12+dfsg-22025.12+dfsg-2~bpo13+12025.12+dfsg-32025.12+dfsg-42025.12+dfsg-52025.12+dfsg-62025.12+dfsg-72025.12+dfsg-7~bpo13+12025.12+dfsg-82025.12+dfsg-9 |
2025.12+dfsg-10 |
Mongoose_jllJulia |
before 7.21.0+0 | 7.21.0+0 |
swupdateUbuntu:22.04:LTS |
All versions, plus listed versions 2020.11-22021.04-1.12021.04-22021.04-2build12021.11-1 |
None known |
swupdateUbuntu:24.04:LTS |
All versions, plus listed versions 2023.05+dfsg-32023.05+dfsg-42023.05+dfsg-4build12023.05+dfsg-52023.12+dfsg-12023.12.1+dfsg-1ubuntu12023.12.1+dfsg-1ubuntu42023.12.1+dfsg-1ubuntu5 |
None known |
swupdateUbuntu:25.10 |
All versions, plus listed versions 2024.12.1+dfsg-1build22024.12.1+dfsg-22024.12.1+dfsg-32025.05+dfsg-2ubuntu1 |
None known |
swupdateUbuntu:26.10 |
All versions, plus listed versions 2025.12+dfsg-4ubuntu12026.05+dfsg-3ubuntu22026.05+dfsg-4ubuntu12026.05.1+dfsg-1ubuntu12026.05.1+git20261001+dfsg-1ubuntu1 |
None known |
swupdateUbuntu:26.04:LTS |
All versions, plus listed versions 2025.05+dfsg-2ubuntu12025.05+dfsg-3ubuntu12025.12+dfsg-1ubuntu12025.12+dfsg-2ubuntu12025.12+dfsg-3ubuntu12025.12+dfsg-4ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-5244 is a medium vulnerability (CVSS 6.9) in Automattic Mongoose, published April 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.76%, the 55th percentile. Fixed in swupdate 2025.12+dfsg-10.
References
Left out here: 9 versions. The JSON record has them.