TI-2026-51393 CVE-2026-73257
Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling
Priority HIGH 80
Mongoose is an embedded web server and network library.
Cesanta
Records155All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical27CVSS 9.0–10.0
CVSS high40CVSS 7.0–8.9
Exploited now
Cesanta records in CISA KEVNo Cesanta vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
55 records in Mongoose · all components
TI-2026-51389 CVE-2026-73253
Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching
Priority HIGH 74
Mongoose is an embedded web server and network library.
TI-2023-02723 CVE-2023-2905 · GHSA-pv78-3m65-h826
Cesanta Mongoose MQTT Message Parsing Heap Overflow
Priority HIGH 73
Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web server, version 7.10 is susceptible to a heap-based buffer overfl…
TI-2020-15865 CVE-2020-25887 · GHSA-mj7x-c9vq-67qh
Buffer overflow in mg_resolve_from_hosts_file in Mongoose 6.18, when reading from a crafted hosts file.
Priority HIGH 73
Buffer overflow in mg_resolve_from_hosts_file in Mongoose 6.18, when reading from a crafted hosts file.
TI-2023-17032 CVE-2023-34188 · GHSA-pcw9-xw4x-jgj3
The HTTP server in Mongoose before 7.10 accepts requests containing negative…
Priority HIGH 72
The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers.
TI-2026-06113 CVE-2026-6985 · GHSA-3ppf-435x-3p66
Cesanta Mongoose TCP Option net_builtin.c handle_opt infinite loop
Priority HIGH 70
A weakness has been identified in Cesanta Mongoose up to 7.20.
TI-2019-13923 CVE-2019-19307 · GHSA-qcx8-9vm4-9g3r
An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an…
Priority HIGH 70
An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infinite loop), or possibly cause an out-of-bounds write, by sending a crafted MQTT protocol packet.
TI-2026-51394 CVE-2026-73258
Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart
Priority HIGH 68
Mongoose is an embedded web server and network library.
TI-2025-32347 CVE-2025-51495 · GHSA-83rc-g55p-8xj2
An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru…
Priority HIGH 66
An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17.
TI-2017-02114 CVE-2017-2894 · GHSA-gm65-9xpq-9g64
Out-of-bounds write in Cesanta Mongoose
Priority HIGH 66
An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8.
TI-2026-51391 CVE-2026-73255
Mongoose: Path traversal in SSI #include directives enables arbitrary file read
Priority MEDIUM 62
Mongoose is an embedded web server and network library.
TI-2026-06114 CVE-2026-6986 · GHSA-p5j9-fjff-qrmr
Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verification
Priority MEDIUM 61
A security vulnerability has been detected in Cesanta Mongoose up to 7.20.
TI-2026-04582 CVE-2026-5246 · GHSA-hm7q-jq63-pr78
Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization
Priority MEDIUM 61
A vulnerability was determined in Cesanta Mongoose up to 7.20.
TI-2026-02560 CVE-2026-2968 · GHSA-jprc-mg35-68jq
Cesanta Mongoose Poly1305 Authentication Tag tls_chacha20.c mg_chacha20_poly1305_decrypt signature verification
Priority MEDIUM 61
A vulnerability was detected in Cesanta Mongoose up to 7.20.
TI-2026-02559 CVE-2026-2967 · GHSA-c6h3-vh8h-r8mj
Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of source
Priority MEDIUM 61
A security vulnerability has been detected in Cesanta Mongoose up to 7.20.
TI-2026-02558 CVE-2026-2966 · GHSA-m5mm-h952-fxjj
Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values
Priority MEDIUM 61
A weakness has been identified in Cesanta Mongoose up to 7.20.
Priority MEDIUM 58
Mongoose is an embedded web server and network library.
Priority MEDIUM 58
Mongoose is an embedded web server and network library.
TI-2017-02113 CVE-2017-2893 · GHSA-rghw-3hw7-m66h
NULL pointer dereference in Cesanta Mongoose
Priority MEDIUM 54
An exploitable NULL pointer dereference vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8.
TI-2026-51392 CVE-2026-73256
Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE
Priority MEDIUM 48
Mongoose is an embedded web server and network library.
TI-2018-14410 CVE-2018-20356 · GHSA-2hwq-hrjc-wwr4
An invalid read of 8 bytes due to a use-after-free vulnerability in the…
Priority MEDIUM 48
An invalid read of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service…
TI-2018-14409 CVE-2018-20355 · GHSA-9q6r-hpgq-gfqm
An invalid write of 8 bytes due to a use-after-free vulnerability in the…
Priority MEDIUM 48
An invalid write of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service…
TI-2018-14408 CVE-2018-20354 · GHSA-x5cj-69cr-cfj3
An invalid read of 8 bytes due to a use-after-free vulnerability during a "return" in the…
Priority MEDIUM 48
An invalid read of 8 bytes due to a use-after-free vulnerability during a "return" in the mg_http_get_proto_data function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of…
TI-2018-14407 CVE-2018-20353 · GHSA-6vw4-wcwf-h6g7
An invalid read of 8 bytes due to a use-after-free vulnerability during a "NULL test" in…
Priority MEDIUM 48
An invalid read of 8 bytes due to a use-after-free vulnerability during a "NULL test" in the mg_http_get_proto_data function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial…
TI-2017-02112 CVE-2017-2892 · GHSA-fcj6-8xpv-3w93
Integer overflow in Cesanta Mongoose
Priority MEDIUM 48
An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8.