Cesanta Mongoose vulnerabilities

• automattic mongoose Mongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c) CVE-2026-115473 Fix available 6.5 MediumNovember 4, 2026
• automattic mongoose Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6) CVE-2026-63626 Fix available 8.8 HighOctober 14, 2026
• automattic mongoose Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connection CVE-2026-73261 Fix available 7.5 HighOctober 14, 2026
• automattic mongoose Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser CVE-2026-73260 Fix available 7.5 HighOctober 14, 2026
• automattic mongoose Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAX CVE-2026-73252 Fix available 7.5 HighOctober 14, 2026
• automattic mongoose Cesanta Mongoose MQTT Broker main.c fn stack-based overflow CVE-2026-101003 Fix available 6.9 MediumSeptember 28, 2026
• automattic mongoose Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching CVE-2026-73253 Fix available 9.1 CriticalAugust 20, 2026
• automattic mongoose Mongoose: Path traversal in SSI #include directives enables arbitrary file read CVE-2026-73255 Fix available 6.5 MediumAugust 20, 2026
• automattic mongoose Mongoose: Reflected XSS via decoded URI in directory listing render CVE-2026-73259 Fix available 5.4 MediumAugust 20, 2026
• automattic mongoose Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE CVE-2026-73256 Fix available 9.1 CriticalAugust 20, 2026
• automattic mongoose Mongoose: Stored XSS via unescaped filenames in directory listing CVE-2026-73254 Fix available 5.4 MediumAugust 20, 2026
• automattic mongoose Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart CVE-2026-73258 Fix available 6.5 MediumAugust 20, 2026
• automattic mongoose Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification CVE-2026-73251 Fix available 9.3 CriticalAugust 20, 2026
• automattic mongoose Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling CVE-2026-73257 Fix available 9.1 CriticalAugust 20, 2026
• automattic mongoose Cesanta Mongoose Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID Parsing CVE-2026-11404 Fix available 8.7 HighJuly 9, 2026
• automattic mongoose Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verification CVE-2026-6986 Fix available 6.3 MediumApril 25, 2026
• automattic mongoose Cesanta Mongoose TCP Option net_builtin.c handle_opt infinite loop CVE-2026-6985 Fix available 6.9 MediumApril 25, 2026
• automattic mongoose Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization CVE-2026-5246 Fix available 6.3 MediumApril 2, 2026
• automattic mongoose Cesanta Mongoose mDNS Record mongoose.c handle_mdns_record stack-based overflow CVE-2026-5245 Fix available 6.3 MediumApril 2, 2026
• automattic mongoose Cesanta Mongoose TLS 1.3 mongoose.c mg_tls_recv_cert heap-based overflow CVE-2026-5244 Fix available 6.9 MediumApril 2, 2026
• cesanta mongoose web server Mongoose Web Server 6.9 Denial of Service via Socket Connection CVE-2018-25193 8.7 HighMarch 6, 2026
• automattic mongoose Cesanta Mongoose Poly1305 Authentication Tag tls_chacha20.c mg_chacha20_poly1305_decrypt signature verification CVE-2026-2968 Fix available 6.3 MediumFebruary 23, 2026
• automattic mongoose Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of source CVE-2026-2967 Fix available 6.3 MediumFebruary 23, 2026
• automattic mongoose Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values CVE-2026-2966 Fix available 6.3 MediumFebruary 23, 2026
• cesanta mongoose Null pointer dereference in add_ca_certs() in Cesanta Mongoose before 7.2 allows remote attackers... CVE-2025-65502 Fix available 4.3 MediumNovember 24, 2025
• cesanta mongoose An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17. By... CVE-2025-51495 Public exploitFix available 7.5 HighSeptember 29, 2025
• cesanta mongoose, mongoose web server, siemens reyrolle 7sr5 +2 more Improper Neutralization of Delimiters in Mongoose Web Server library CVE-2024-42392 4.0 MediumNovember 18, 2024
• cesanta mongoose, mongoose web server, siemens reyrolle 7sr5 +2 more Use of Out-of-range Pointer Offset in Mongoose Web Server library CVE-2024-42391 4.3 MediumNovember 18, 2024
• cesanta mongoose, mongoose web server +1 more Use of Out-of-range Pointer Offset in Mongoose Web Server library CVE-2024-42390 4.3 MediumNovember 18, 2024
• cesanta mongoose, mongoose web server +1 more Use of Out-of-range Pointer Offset in Mongoose Web Server library CVE-2024-42389 5.3 MediumNovember 18, 2024
• cesanta mongoose, mongoose web server +1 more Use of Out-of-range Pointer Offset in Mongoose Web Server library CVE-2024-42388 5.3 MediumNovember 18, 2024
• cesanta mongoose, mongoose web server +1 more Use of Out-of-range Pointer Offset in Mongoose Web Server library CVE-2024-42387 5.3 MediumNovember 18, 2024
• cesanta mongoose, mongoose web server, siemens reyrolle 7sr5 +2 more Use of Out-of-range Pointer Offset in Mongoose Web Server library CVE-2024-42386 8.2 HighNovember 18, 2024
• cesanta mongoose, mongoose web server, siemens reyrolle 7sr5 +2 more Improper Neutralization of Delimiters in Mongoose Web Server library CVE-2024-42385 4.0 MediumNovember 18, 2024
• cesanta mongoose, mongoose web server, siemens reyrolle 7sr5 +2 more Integer Overflow or Wraparound in Mongoose Web Server library CVE-2024-42384 7.5 HighNovember 18, 2024
• cesanta mongoose, mongoose web server +1 more Use of Out-of-range Pointer Offset in Mongoose Web Server library CVE-2024-42383 4.2 MediumNovember 18, 2024
• cesanta mongoose Cesanta Mongoose commit b316989 was discovered to contain a NULL pointer dereference via the scpy function at src/fmt.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a cr… CVE-2024-35492 7.5 HighMay 29, 2024
• cesanta mongoose Buffer overflow in mg_resolve_from_hosts_file in Mongoose 6.18, when reading from a crafted hosts... CVE-2020-25887 Fix available 8.8 HighAugust 22, 2023
• automattic mongoose Cesanta Mongoose MQTT Message Parsing Heap Overflow CVE-2023-2905 Fix available 8.8 HighAugust 9, 2023
• cesanta mongoose The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. CVE-2023-34188 Fix available 7.5 HighJune 23, 2023
• cesanta software mongoose-os, cesanta mongoose os +1 more Cesanta Software Mongoose-OS Integer Overflow or Wraparound CVE-2021-27425 7.3 HighMay 3, 2022
• cesanta mongoose Arbitrary File Write CVE-2022-25299 9.8 CriticalFebruary 18, 2022
• cesanta mongooseos mjs In mjs_json.c in Cesanta MongooseOS mJS 1.26, a maliciously formed JSON string can trigger an off... CVE-2021-31875 Disputed 9.8 CriticalApril 29, 2021
• cesanta mongoose The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 (compiled with OpenSSL support) is... CVE-2021-26530 Fix available 9.1 CriticalFebruary 8, 2021
• cesanta mongoose The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS... CVE-2021-26529 Fix available 9.1 CriticalFebruary 8, 2021
• cesanta mongoose The mg_http_serve_file function in Cesanta Mongoose HTTP server 7.0 is vulnerable to remote OOB... CVE-2021-26528 Fix available 9.1 CriticalFebruary 8, 2021
• cesanta mongoose ** DISPUTED ** A buffer overflow vulnerability exists in the mg_get_http_header function in... CVE-2020-25756 Fix availableDisputed 9.8 CriticalSeptember 18, 2020
• cesanta mongoose An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to... CVE-2019-19307 Fix available EPSS 42.2% 9.8 CriticalNovember 26, 2019
• cesanta mongoose mq_parse_http in mongoose.c in Mongoose 6.15 has a heap-based buffer over-read. CVE-2019-13503 Fix available 7.5 HighJuly 11, 2019
• cesanta mongoose An issue was discovered in Mongoose before 6.15. The parse_mqtt() function in mg_mqtt.c has a... CVE-2019-12951 Fix available 9.8 CriticalJune 24, 2019
• Show olderLoading…