Priority HIGH 82
Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the function mjs_get_ptr().
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00987 · Published 2023-09-22 · No fix listed CWE-787
Priority HIGH 80
Mongoose is an embedded web server and network library.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00673 · Published 2026-08-20 · Fixed in 7.22 CWE-444
Priority HIGH 77
Mongoose Web Server 6.9 contains a denial of service vulnerability that allows remote attackers to crash the service by establishing multiple socket connections.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00386 · Published 2026-03-06 · No fix listed CWE-1188
Priority HIGH 74
Mongoose is an embedded web server and network library.
CVSS 4.0CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00344 · Published 2026-08-20 · Fixed in 7.22 CWE-295
Priority HIGH 73
Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web server, version 7.10 is susceptible to a heap-based buffer overfl…
CVSS 3.1HIGH 8.8· Adjacent network · No auth · No interaction · EPSS 0.01006 · Published 2023-08-09 · Fixed in 7.11 CWE-122
Priority HIGH 73
Buffer overflow in mg_resolve_from_hosts_file in Mongoose 6.18, when reading from a crafted hosts file.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00703 · Published 2023-08-22 · No fix listed CWE-120
Priority HIGH 72
Mongoose is an embedded web server and network library.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00417 · Published 2026-10-14 · Fixed in 7.23 CWE-125
Priority HIGH 72
Mongoose is an embedded web server and network library.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0023 · Published 2026-10-14 · Fixed in 7.23 CWE-125
Priority HIGH 72
Mongoose is an embedded web server and network library.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00376 · Published 2026-10-14 · Fixed in 7.23 CWE-125
Priority HIGH 72
An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_destroy function in the msj.c file.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00857 · Published 2024-01-02 · No fix listed
Priority HIGH 72
An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_parse function in the msj.c file.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00759 · Published 2024-01-02 · No fix listed CWE-20
Priority HIGH 72
An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs+0x4ec508 component.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00758 · Published 2024-01-02 · No fix listed CWE-400
Priority HIGH 72
The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01005 · Published 2023-06-23 · No fix listed CWE-1284
Priority HIGH 70
A vulnerability was determined in Cesanta mJS up to 1.26.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.0057 · Published 2026-09-08 · No fix listed CWE-119
Priority HIGH 70
A weakness has been identified in Cesanta Mongoose up to 7.20.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00565 · Published 2026-04-25 · Fixed in 7.21 CWE-404
Priority HIGH 70
An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infinite loop), or possibly cause an out-of-bounds write, by sending a crafted MQTT protocol packet.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.42246 · Published 2019-11-26 · No fix listed CWE-125
Priority HIGH 68
Mongoose is an embedded web server and network library.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00264 · Published 2026-11-04 · Fixed in 7.22 CWE-125
Priority HIGH 68
Mongoose is an embedded web server and network library.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00459 · Published 2026-08-20 · Fixed in 7.22 CWE-697
Priority HIGH 66
An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00424 · Published 2025-09-29 · No fix listed CWE-190
Priority HIGH 66
An Out of Bounds Write in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_stringify function in the msj.c file.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00759 · Published 2024-01-02 · No fix listed CWE-787
Priority HIGH 66
An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_getretvalpos function in the msj.c file.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00758 · Published 2024-01-02 · No fix listed
Priority HIGH 66
An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.31045 · Published 2017-11-07 · No fix listed CWE-787
Priority MEDIUM 62
Mongoose is an embedded web server and network library.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00657 · Published 2026-08-20 · Fixed in 7.22 CWE-22
Priority MEDIUM 61
A security vulnerability has been detected in Cesanta Mongoose up to 7.20.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00217 · Published 2026-04-25 · Fixed in 7.21 CWE-345
Priority MEDIUM 61
A vulnerability was determined in Cesanta Mongoose up to 7.20.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00647 · Published 2026-04-02 · Fixed in 7.21 CWE-285
Load more
THREATIST.IORead the docs