Every CVE Search/ Get API key

CVE-2026-5245

Cesanta Mongoose mDNS Record mongoose.c handle_mdns_record stack-based overflow

6.3 MediumFix available

A vulnerability was found in Cesanta Mongoose up to 7.20. This impacts the function handle_mdns_record of the file mongoose.c of the component mDNS Record Handler. Performing a manipulation of the argument buf results in stack-based buffer overflow. Remote exploitation of the attack is possible. A high degree of complexity is needed for the attack. The exploitability is said to be difficult. The exploit has been made public and could be used. Upgrading to version 7.21 will fix this issue. The patch is named 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.73%Up 0.7 points since Apr 2, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.3

Cesanta Mongoose mDNS Record mongoose.c handle_mdns_record stack-based overflow

A vulnerability was found in Cesanta Mongoose up to 7.20. This impacts the function handle_mdns_record of the file mongoose.c of the component mDNS Record Handler. Performing a manipulation of the argument buf results in stack-based buffer overflow. Remote exploitation of the attack is possible. A high degree of complexity is needed for the attack. The exploitability is said to be difficult. The exploit has been made public and could be used. Upgrading to version 7.21 will fix this issue. The patch is named 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Record
CVE-2026-5245
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CVSS 3.0
5.6 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
CVSS 2.0
5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C
Weakness
CWE-121, CWE-119
Updated
2026-11-02
EUVDEUVD-2026-18183 6.3

A vulnerability was found in Cesanta Mongoose up to 7.20. This impacts the function handle_mdns_record of the file mongoose.c of the component mDNS Record Handler. Performing a manipulation of the argument buf results in stack-based buffer overflow. Remote exploitation of the attack is possible. A high degree of complexity is needed for the attack. The exploitability is said to be difficult. The exploit has been made public and could be used. Upgrading to version 7.21 will fix this issue. The patch is named 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Record
EUVD-2026-18183
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
GitHub AdvisoriesGHSA-2rqj-7x75-2684 2.9

A vulnerability was found in Cesanta Mongoose up to 7.20. This impacts the function...

A vulnerability was found in Cesanta Mongoose up to 7.20. This impacts the function handle_mdns_record of the file mongoose.c of the component mDNS Record Handler. Performing a manipulation of the argument buf results in stack-based buffer overflow. Remote exploitation of the attack is possible. A high degree of complexity is needed for the attack. The exploitability is said to be difficult. The exploit has been made public and could be used. Upgrading to version 7.21 will fix this issue. The patch is named 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Record
GHSA-2rqj-7x75-2684
CVSS 4.0
2.9 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness
CWE-119
Updated
2026-11-02
NVD 2.9

A vulnerability was found in Cesanta Mongoose up to 7.20. This impacts the function handle_mdns_record of the file mongoose.c of the component mDNS Record Handler. Performing a manipulation of the argument buf results in stack-based buffer overflow. Remote exploitation of the attack is possible. A high degree of complexity is needed for the attack. The exploitability is said to be difficult. The exploit has been made public and could be used. Upgrading to version 7.21 will fix this issue. The patch is named 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Record
CVE-2026-5245
CVSS 4.0
2.9 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
5.1 MediumAV:N/AC:H/Au:N/C:P/I:P/A:P
Weakness
CWE-119, CWE-121
Updated
2026-11-02
OSV 2.9

Cesanta Mongoose mDNS Record mongoose.c handle_mdns_record stack-based overflow

A vulnerability was found in Cesanta Mongoose up to 7.20. This impacts the function handle_mdns_record of the file mongoose.c of the component mDNS Record Handler. Performing a manipulation of the argument buf results in stack-based buffer overflow. Remote exploitation of the attack is possible. A high degree of complexity is needed for the attack. The exploitability is said to be difficult. The exploit has been made public and could be used. Upgrading to version 7.21 will fix this issue. The patch is named 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Record
CVE-2026-5245
CVSS 4.0
2.9 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Weakness
CWE-119, CWE-121
Updated
2026-11-02
OSVDEBIAN-CVE-2026-5245 8.1

A vulnerability was found in Cesanta Mongoose up to 7.20. This impacts the function handle_mdns_record of the file mongoose.c of the component mDNS Record Handler. Performing a manipulation of the argument buf results in stack-based buffer overflow. Remote exploitation of the attack is possible. A high degree of complexity is needed for the attack. The exploitability is said to be difficult. The exploit has been made public and could be used. Upgrading to version 7.21 will fix this issue. The patch is named 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Record
DEBIAN-CVE-2026-5245
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVJLSEC-2026-370 2.9

A vulnerability was found in Cesanta Mongoose up to 7.20

A vulnerability was found in Cesanta Mongoose up to 7.20. This impacts the function handle_mdns_record of the file mongoose.c of the component mDNS Record Handler. Performing a manipulation of the argument buf results in stack-based buffer overflow. Remote exploitation of the attack is possible. A high degree of complexity is needed for the attack. The exploitability is said to be difficult. The exploit has been made public and could be used. Upgrading to version 7.21 will fix this issue. The patch is named 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Record
JLSEC-2026-370
CVSS 4.0
2.9 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 2.0
5.1 MediumAV:N/AC:H/Au:N/C:P/I:P/A:P
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-5245 2.9

A vulnerability was found in Cesanta Mongoose up to 7.20. This impacts the function handle_mdns_record of the file mongoose.c of the component mDNS Record Handler. Performing a manipulation of the argument buf results in stack-based buffer overflow. Remote exploitation of the attack is possible. A high degree of complexity is needed for the attack. The exploitability is said to be difficult. The exploit has been made public and could be used. Upgrading to version 7.21 will fix this issue. The patch is named 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Record
UBUNTU-CVE-2026-5245
CVSS 4.0
2.9 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1
5.6 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
swupdate
Debian:12
All versions, plus listed versions
2022.12+dfsg-42022.12+dfsg-4+deb12u12022.12+dfsg-4+deb12u1~bpo11+12022.12+dfsg-4+deb12u22022.12+dfsg-4+deb12u3
Show 45 moreShow less
2023.05+dfsg-12023.05+dfsg-22023.05+dfsg-2~bpo12+12023.05+dfsg-32023.05+dfsg-42023.05+dfsg-52023.05+dfsg-5~bpo12+12023.12+dfsg-12023.12+dfsg-1~bpo12+12023.12.1+dfsg-12023.12.1+dfsg-1~bpo12+12023.12.1+dfsg-22023.12.1+dfsg-2~bpo12+12024.05+dfsg-12024.05.2+dfsg-12024.05.2+dfsg-22024.05.2+dfsg-2~bpo12+12024.12+dfsg-12024.12+dfsg-22024.12+dfsg-2~bpo12+12024.12.1+dfsg-12024.12.1+dfsg-1~bpo12+12024.12.1+dfsg-22024.12.1+dfsg-32024.12.1+dfsg-3~bpo12+12025.05+dfsg-12025.05+dfsg-22025.05+dfsg-2~bpo13+12025.05+dfsg-32025.05+dfsg-3~bpo13+12025.12+dfsg-12025.12+dfsg-102025.12+dfsg-10~bpo13+12025.12+dfsg-10~bpo13+22025.12+dfsg-22025.12+dfsg-2~bpo13+12025.12+dfsg-32025.12+dfsg-42025.12+dfsg-52025.12+dfsg-62025.12+dfsg-72025.12+dfsg-7~bpo13+12025.12+dfsg-82025.12+dfsg-92026.05+dfsg-1
None known
swupdate
Debian:13
All versions, plus listed versions
2024.12.1+dfsg-32024.12.1+dfsg-3+deb13u12024.12.1+dfsg-3+deb13u22025.05+dfsg-12025.05+dfsg-2
Show 27 moreShow less
2025.05+dfsg-2~bpo13+12025.05+dfsg-32025.05+dfsg-3~bpo13+12025.12+dfsg-12025.12+dfsg-102025.12+dfsg-10~bpo13+12025.12+dfsg-10~bpo13+22025.12+dfsg-22025.12+dfsg-2~bpo13+12025.12+dfsg-32025.12+dfsg-42025.12+dfsg-52025.12+dfsg-62025.12+dfsg-72025.12+dfsg-7~bpo13+12025.12+dfsg-82025.12+dfsg-92026.05+dfsg-12026.05+dfsg-22026.05+dfsg-32026.05+dfsg-3~bpo13+12026.05+dfsg-42026.05.1+dfsg-12026.05.1+dfsg-1~bpo13+12026.05.1+git20261001+dfsg-12026.05.1+git20261001+dfsg-22026.05.1+git20261001+dfsg-2~bpo13+1
None known
swupdate
Debian:14
before 2025.12+dfsg-10, plus listed versions
2024.12.1+dfsg-32025.05+dfsg-12025.05+dfsg-22025.05+dfsg-2~bpo13+12025.05+dfsg-3
Show 14 moreShow less
2025.05+dfsg-3~bpo13+12025.12+dfsg-12025.12+dfsg-10~bpo13+12025.12+dfsg-10~bpo13+22025.12+dfsg-22025.12+dfsg-2~bpo13+12025.12+dfsg-32025.12+dfsg-42025.12+dfsg-52025.12+dfsg-62025.12+dfsg-72025.12+dfsg-7~bpo13+12025.12+dfsg-82025.12+dfsg-9
2025.12+dfsg-10
Mongoose_jll
Julia
before 7.21.0+0
7.21.0+0
swupdate
Ubuntu:22.04:LTS
All versions, plus listed versions
2020.11-22021.04-1.12021.04-22021.04-2build12021.11-1
None known
swupdate
Ubuntu:24.04:LTS
All versions, plus listed versions
2023.05+dfsg-32023.05+dfsg-42023.05+dfsg-4build12023.05+dfsg-52023.12+dfsg-12023.12.1+dfsg-1ubuntu12023.12.1+dfsg-1ubuntu42023.12.1+dfsg-1ubuntu5
None known
swupdate
Ubuntu:25.10
All versions, plus listed versions
2024.12.1+dfsg-1build22024.12.1+dfsg-22024.12.1+dfsg-32025.05+dfsg-2ubuntu1
None known
swupdate
Ubuntu:26.10
All versions, plus listed versions
2025.12+dfsg-4ubuntu12026.05+dfsg-3ubuntu22026.05+dfsg-4ubuntu12026.05.1+dfsg-1ubuntu12026.05.1+git20261001+dfsg-1ubuntu1
None known
swupdate
Ubuntu:26.04:LTS
All versions, plus listed versions
2025.05+dfsg-2ubuntu12025.05+dfsg-3ubuntu12025.12+dfsg-1ubuntu12025.12+dfsg-2ubuntu12025.12+dfsg-3ubuntu12025.12+dfsg-4ubuntu1
None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-5245 is a medium vulnerability (CVSS 6.3) in Automattic Mongoose, published April 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.73%, the 54th percentile. Fixed in swupdate 2025.12+dfsg-10.

References

Show 6 moreShow less
This page doesn't list everything

Left out here: 9 versions. The JSON record has them.

MoveEnter Open