mongoose vulnerabilities (Debian)
44 vulnerabilities.
-
mongooseDebian Mongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c) 6.5 Medium -
mongooseDebian Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6) 8.8 High -
mongooseDebian Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connection 7.5 High -
mongooseDebian Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser 7.5 High -
mongooseDebian Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAX 7.5 High -
mongooseDebian Cesanta Mongoose MQTT Broker main.c fn stack-based overflow 6.9 Medium -
mongooseDebian Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching 9.1 Critical -
mongooseDebian Mongoose: Path traversal in SSI #include directives enables arbitrary file read 6.5 Medium -
mongooseDebian Mongoose: Reflected XSS via decoded URI in directory listing render 5.4 Medium -
mongooseDebian Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE 9.1 Critical -
mongooseDebian Mongoose: Stored XSS via unescaped filenames in directory listing 5.4 Medium -
mongooseDebian Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart 6.5 Medium -
mongooseDebian Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification 9.3 Critical -
mongooseDebian Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling 9.1 Critical -
mongooseDebian No score -
mongooseDebian No score -
mongooseDebian No score -
mongooseDebian No score -
mongooseDebian No score -
mongooseDebian No score -
mongooseDebian No score -
mongooseDebian No score -
mongooseDebian No score -
mongooseDebian No score -
mongooseDebian No score -
mongooseDebian No score -
mongooseDebian No score -
mongooseDebian No score -
mongooseDebian No score -
mongooseDebian No score -
mongooseDebian No score -
mongooseDebian No score -
mongooseDebian No score -
mongooseDebian No score -
mongooseDebian No score -
mongooseDebian No score -
mongooseDebian No score -
mongooseDebian No score -
mongooseDebian No score -
mongooseDebian No score -
mongooseDebian No score -
mongooseDebian No score -
mongooseDebian No score -
mongooseDebian Cesanta Mongoose Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID Parsing 8.7 High