Cesanta vulnerabilities

Products

• Mjs 85
• Mongoose 63
• Mongoose Web Server 11
• Mongoose Embedded Web Server Library 3
• Frozen 2
• Mongoose Os 2

Newest

• automattic mongoose Mongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c) CVE-2026-115473 6.5 MediumNovember 4, 2026
• automattic mongoose Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6) CVE-2026-63626 Fix available 8.8 HighOctober 14, 2026
• automattic mongoose Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connection CVE-2026-73261 Fix available 7.5 HighOctober 14, 2026
• automattic mongoose Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser CVE-2026-73260 Fix available 7.5 HighOctober 14, 2026
• automattic mongoose Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAX CVE-2026-73252 Fix available 7.5 HighOctober 14, 2026
• automattic mongoose Cesanta Mongoose MQTT Broker main.c fn stack-based overflow CVE-2026-101003 Fix available 6.9 MediumSeptember 28, 2026
• cesanta mjs Cesanta mJS mjs_tok.c skip_spaces_and_comments heap-based overflow CVE-2026-86716 6.9 MediumSeptember 8, 2026
• automattic mongoose Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching CVE-2026-73253 Fix available 9.1 CriticalAugust 20, 2026
• automattic mongoose Mongoose: Path traversal in SSI #include directives enables arbitrary file read CVE-2026-73255 Fix available 6.5 MediumAugust 20, 2026
• automattic mongoose Mongoose: Reflected XSS via decoded URI in directory listing render CVE-2026-73259 Fix available 5.4 MediumAugust 20, 2026
• automattic mongoose Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE CVE-2026-73256 Fix available 9.1 CriticalAugust 20, 2026
• automattic mongoose Mongoose: Stored XSS via unescaped filenames in directory listing CVE-2026-73254 Fix available 5.4 MediumAugust 20, 2026
• automattic mongoose Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart CVE-2026-73258 Fix available 6.5 MediumAugust 20, 2026
• automattic mongoose Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification CVE-2026-73251 Fix available 9.3 CriticalAugust 20, 2026
• automattic mongoose Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling CVE-2026-73257 Fix available 9.1 CriticalAugust 20, 2026
• automattic mongoose Cesanta Mongoose Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID Parsing CVE-2026-11404 Fix available 8.7 HighJuly 9, 2026
• automattic mongoose Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verification CVE-2026-6986 Fix available 6.3 MediumApril 25, 2026
• automattic mongoose Cesanta Mongoose TCP Option net_builtin.c handle_opt infinite loop CVE-2026-6985 Fix available 6.9 MediumApril 25, 2026
• automattic mongoose Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization CVE-2026-5246 Fix available 6.3 MediumApril 2, 2026
• automattic mongoose Cesanta Mongoose mDNS Record mongoose.c handle_mdns_record stack-based overflow CVE-2026-5245 Fix available 6.3 MediumApril 2, 2026
• automattic mongoose Cesanta Mongoose TLS 1.3 mongoose.c mg_tls_recv_cert heap-based overflow CVE-2026-5244 Fix available 6.9 MediumApril 2, 2026
• cesanta mongoose web server Mongoose Web Server 6.9 Denial of Service via Socket Connection CVE-2018-25193 8.7 HighMarch 6, 2026
• automattic mongoose Cesanta Mongoose Poly1305 Authentication Tag tls_chacha20.c mg_chacha20_poly1305_decrypt signature verification CVE-2026-2968 Fix available 6.3 MediumFebruary 23, 2026
• automattic mongoose Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of source CVE-2026-2967 Fix available 6.3 MediumFebruary 23, 2026
• automattic mongoose Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values CVE-2026-2966 Fix available 6.3 MediumFebruary 23, 2026
• cesanta mongoose Null pointer dereference in add_ca_certs() in Cesanta Mongoose before 7.2 allows remote attackers... CVE-2025-65502 Fix available 4.3 MediumNovember 24, 2025
• cesanta mongoose An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17. By... CVE-2025-51495 Public exploitFix available 7.5 HighSeptember 29, 2025
• cesanta frozen A NULL Pointer Dereference vulnerability in Cesanta Frozen versions less than 1.7 allows an... CVE-2025-0696 5.3 MediumJanuary 27, 2025
• cesanta frozen An Allocation of Resources Without Limits or Throttling vulnerability in Cesanta Frozen versions... CVE-2025-0695 5.3 MediumJanuary 27, 2025
• cesanta mongoose, mongoose web server, siemens reyrolle 7sr5 +2 more Improper Neutralization of Delimiters in Mongoose Web Server library CVE-2024-42392 4.0 MediumNovember 18, 2024
• cesanta mongoose, mongoose web server, siemens reyrolle 7sr5 +2 more Use of Out-of-range Pointer Offset in Mongoose Web Server library CVE-2024-42391 4.3 MediumNovember 18, 2024
• cesanta mongoose, mongoose web server +1 more Use of Out-of-range Pointer Offset in Mongoose Web Server library CVE-2024-42390 4.3 MediumNovember 18, 2024
• cesanta mongoose, mongoose web server +1 more Use of Out-of-range Pointer Offset in Mongoose Web Server library CVE-2024-42389 5.3 MediumNovember 18, 2024
• cesanta mongoose, mongoose web server +1 more Use of Out-of-range Pointer Offset in Mongoose Web Server library CVE-2024-42388 5.3 MediumNovember 18, 2024
• cesanta mongoose, mongoose web server +1 more Use of Out-of-range Pointer Offset in Mongoose Web Server library CVE-2024-42387 5.3 MediumNovember 18, 2024
• cesanta mongoose, mongoose web server, siemens reyrolle 7sr5 +2 more Use of Out-of-range Pointer Offset in Mongoose Web Server library CVE-2024-42386 8.2 HighNovember 18, 2024
• cesanta mongoose, mongoose web server, siemens reyrolle 7sr5 +2 more Improper Neutralization of Delimiters in Mongoose Web Server library CVE-2024-42385 4.0 MediumNovember 18, 2024
• cesanta mongoose, mongoose web server, siemens reyrolle 7sr5 +2 more Integer Overflow or Wraparound in Mongoose Web Server library CVE-2024-42384 7.5 HighNovember 18, 2024
• cesanta mongoose, mongoose web server +1 more Use of Out-of-range Pointer Offset in Mongoose Web Server library CVE-2024-42383 4.2 MediumNovember 18, 2024
• cesanta mongoose Cesanta Mongoose commit b316989 was discovered to contain a NULL pointer dereference via the scpy function at src/fmt.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a cr… CVE-2024-35492 7.5 HighMay 29, 2024
• cesanta mjs An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the... CVE-2024-35385 4.3 MediumMay 21, 2024
• cesanta mjs An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the... CVE-2024-35384 5.5 MediumMay 21, 2024
• cesanta mjs An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the... CVE-2024-35386 7.5 HighMay 21, 2024
• cesanta mjs An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the... CVE-2023-49553 7.5 HighJanuary 2, 2024
• cesanta mjs An Out of Bounds Write in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of... CVE-2023-49552 7.5 HighJanuary 2, 2024
• cesanta mjs An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the... CVE-2023-49551 7.5 HighJanuary 2, 2024
• cesanta mjs An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs... CVE-2023-49550 7.5 HighJanuary 2, 2024
• cesanta mjs An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the... CVE-2023-49549 7.5 HighJanuary 2, 2024
• cesanta mjs Buffer Overflow vulnerability in Cesanta MJS version 2.22.0, allows attackers to execute... CVE-2023-50044 9.8 CriticalDecember 20, 2023
• cesanta mjs Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the... CVE-2023-43338 9.8 CriticalSeptember 22, 2023
• Show olderLoading…