Vulnerability · Published Jul 9, 2026 · Assigned by VulnCheck

CVE-2026-11404Cesanta Mongoose Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID Parsing

High 7.5

In plain English

A high-severity out-of-bounds read in Mongoose from Cesanta. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.8%top 43.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function mg_tls_server_recv_hello(), which uses an attacker-controlled session_id_len byte from a TLS ClientHello as a buffer index without validating it against the length of received data. A remote, unauthenticated attacker can send a single crafted ClientHello with an oversized session id length to read past the receive buffer, crashing any HTTPS, MQTTS, or WSS service built on MG_TLS_BUILTIN.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:14	mongoose	7.22+ds-1	DEBIAN-CVE-2026-11404
Ubuntu:26.10	mongoose	no fix listed	UBUNTU-CVE-2026-11404

Affected products (as reported)

Vendor	Product	Versions
Cesanta	Mongoose	0 – before 7.22

Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Mongoose 7.22 Release Notes patch, release-notes
Product product
VulnCheck Advisory: Cesanta Mongoose < 7.22 Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID Parsing third-party-advisory