What’s Vulnerable › Vulnerabilities

CVE-2025-51495

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-09-29 · updated 2026-06-17
• Weakness: CWE-190

Description

An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17. By sending a specially crafted WebSocket request, an attacker can cause the application to crash. If downstream vendors integrate this component improperly, the issue may lead to a buffer overflow.

Affected products

• Cesanta Mongoose: from 7.5 through 7.17

References

• https://github.com/cainiao159357/CVE-2025-51495
• https://github.com/cesanta/mongoose
• https://github.com/cesanta/mongoose/pull/3131

Get alerted when CVE-2025-51495 or the next vulnerability affects your stack