CVE-2024-42386: Use of Out-of-range Pointer Offset in Mongoose Web Server library

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-18 · updated 2026-09-08
Weakness: CWE-823

Description

Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentation fault on the application.

Affected products

Cesanta Mongoose: through 7.14

References

https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-42386
https://cert-portal.siemens.com/productcert/html/ssa-142885.html

Get alerted when CVE-2024-42386 or the next vulnerability affects your stack