What’s Vulnerable › Products
Cesanta Mongoose vulnerabilities
63 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 35 published in the last 12 months.
Check whether your Cesanta Mongoose version is affected
Latest Cesanta Mongoose vulnerabilities
- CVE-2026-73261 — Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connection (CVSS 7.5)
- CVE-2026-73260 — Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser (CVSS 7.5)
- CVE-2026-73252 — Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAX (CVSS 7.5)
- CVE-2026-63626 — Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6) (CVSS 8.8)
- CVE-2026-101003 — Cesanta Mongoose MQTT Broker main.c fn stack-based overflow (CVSS 5.3)
- CVE-2026-73259 — Mongoose: Reflected XSS via decoded URI in directory listing render (CVSS 5.4)
- CVE-2026-73258 — Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart (CVSS 6.5)
- CVE-2026-73257 — Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling (CVSS 9.1)
- CVE-2026-73256 — Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE (CVSS 9.1)
- CVE-2026-73255 — Mongoose: Path traversal in SSI #include directives enables arbitrary file read (CVSS 6.5)
- CVE-2026-73254 — Mongoose: Stored XSS via unescaped filenames in directory listing (CVSS 5.4)
- CVE-2026-73253 — Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching (CVSS 9.1)
- CVE-2026-73251 — Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification (CVSS 9.1)
- CVE-2026-11404 — Cesanta Mongoose Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID Parsing (CVSS 7.5)
- CVE-2026-6986 — Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verification (CVSS 3.7)
- CVE-2026-6985 — Cesanta Mongoose TCP Option net_builtin.c handle_opt infinite loop (CVSS 7.5)
- CVE-2026-5246 — Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization (CVSS 8.1)
- CVE-2026-5245 — Cesanta Mongoose mDNS Record mongoose.c handle_mdns_record stack-based overflow (CVSS 8.1)
- CVE-2026-5244 — Cesanta Mongoose TLS 1.3 mongoose.c mg_tls_recv_cert heap-based overflow (CVSS 9.8)
- CVE-2018-25193 — Mongoose Web Server 6.9 Denial of Service via Socket Connection (CVSS 7.5)
- CVE-2026-2968 — Cesanta Mongoose Poly1305 Authentication Tag tls_chacha20.c mg_chacha20_poly1305_decrypt signature verification (CVSS 3.7)
- CVE-2026-2967 — Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of source (CVSS 3.7)
- CVE-2026-2966 — Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values (CVSS 3.7)
- CVE-2025-65502 — (CVSS 4.3)
- CVE-2025-51495 — (CVSS 7.5)