CVE-2024-42385: Improper Neutralization of Delimiters in Mongoose Web Server library

Severity: high (CVSS 7.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-18 · updated 2026-09-08
Weakness: CWE-140

Description

Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an out-of-bound memory write if the PEM certificate contains unexpected characters.

Affected products

Cesanta Mongoose: through 7.14

References

https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-42385
https://cert-portal.siemens.com/productcert/html/ssa-142885.html

Get alerted when CVE-2024-42385 or the next vulnerability affects your stack