CCesanta

Products

Exploited and recent CVEs

• CVE-2026-115473 Medium 6.5 Mongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c) 0.3%
• CVE-2026-63626 High 8.8 Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6) 0.2%
• CVE-2026-73261 High 7.5 Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connection 0.4%
• CVE-2026-73260 High 7.5 Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser 0.2%
• CVE-2026-73252 High 7.5 Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAX 0.4%
• CVE-2026-101003 Medium 5.3 Cesanta Mongoose MQTT Broker main.c fn stack-based overflow 0.5%
• CVE-2026-86716 High 7.3 Cesanta mJS mjs_tok.c skip_spaces_and_comments heap-based overflow 0.6%
• CVE-2026-73253 Critical 9.1 Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching 0.3%
• CVE-2026-73255 Medium 6.5 Mongoose: Path traversal in SSI #include directives enables arbitrary file read 0.7%
• CVE-2026-73259 Medium 5.4 Mongoose: Reflected XSS via decoded URI in directory listing render 0.4%
• CVE-2026-73256 Critical 9.1 Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE 0.4%
• CVE-2026-73254 Medium 5.4 Mongoose: Stored XSS via unescaped filenames in directory listing 0.3%
• CVE-2026-73258 Medium 6.5 Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart 0.5%
• CVE-2026-73251 Critical 9.3 Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification 0.2%
• CVE-2026-73257 Critical 9.1 Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling 0.7%
• CVE-2026-11404 High 7.5 Cesanta Mongoose Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID Parsing 0.8%
• CVE-2026-6986 Low 3.7 Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verification 0.2%
• CVE-2026-6985 Medium 5.3 Cesanta Mongoose TCP Option net_builtin.c handle_opt infinite loop 0.6%
• CVE-2026-5246 Medium 5.6 Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization 0.6%
• CVE-2026-5245 Medium 5.6 Cesanta Mongoose mDNS Record mongoose.c handle_mdns_record stack-based overflow 0.7%
• CVE-2026-5244 High 7.3 Cesanta Mongoose TLS 1.3 mongoose.c mg_tls_recv_cert heap-based overflow 0.8%
• CVE-2026-2968 Low 3.7 Cesanta Mongoose Poly1305 Authentication Tag tls_chacha20.c mg_chacha20_poly1305_decrypt signature verification 0.3%
• CVE-2026-2967 Low 3.7 Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of source 0.6%
• CVE-2026-2966 Low 3.7 Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values 0.4%
• CVE-2025-0696 Medium 5.3 A NULL Pointer Dereference vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the component embedding the library by supplying a maliciously crafted JSON as 0.4%
• CVE-2025-0695 Medium 5.3 An Allocation of Resources Without Limits or Throttling vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the component embedding the library by supplying 0.4%
• CVE-2024-42392 Medium 4.0 Improper Neutralization of Delimiters in Mongoose Web Server library 0.2%
• CVE-2024-42391 Medium 4.3 Use of Out-of-range Pointer Offset in Mongoose Web Server library 0.3%
• CVE-2024-42390 Medium 4.3 Use of Out-of-range Pointer Offset in Mongoose Web Server library 0.3%
• CVE-2024-42389 Medium 5.3 Use of Out-of-range Pointer Offset in Mongoose Web Server library 0.3%