Read the docs
TI-2026-74439 Aliases CVE-2026-63626

Heap overflow and out-of-bounds read in Mongoose PPP IPv6 handling

Priority MEDIUM 40CWE-122Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.

Summary

Mongoose before 7.23 is an embedded web server and network library. Its ppp_handle_ipv6cp() function trusts a 16-bit IPv6CP length field without checking it against the received payload size, a missing bounds check that leads to heap-based buffer overflow (CWE-122). On a PPP or PPPoE link with IPv6 support enabled, an unauthenticated adjacent peer can complete the LCP exchange and send a short Configure-Request with an oversized length, causing out-of-bounds reads and writes beyond heap buffers. The same length misuse can also expose adjacent heap bytes or hang the event loop.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Mongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MG_ENABLE_TCPIP and MG_ENABLE_IPV6, an unauthenticated adjacent peer can complete the required LCP exchange and send a short Configure-Request with an oversized length, causing ppp_tx_frame() to read beyond recv_queue.buf and write beyond tx.buf. The same length misuse can also expose adjacent heap bytes in a reply or hang the event loop through find_opt(). This issue is fixed in version 7.23.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00239 15th percentileScored 2026-11-07
Fix Fixed mongoose (cesanta): 7.23

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Cesantamongoosebefore 7.237.23Patch availableCNA
  • mongoose VendorCesanta Affected before 7.23 Fixed in 7.23 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:cesanta:mongoose:*:*:*:*:*:*:*:*——Cesanta
  • cpe:2.3:a:cesanta:mongoose:*:*:*:*:*:*:*:* Versions — — ·Cesanta

Remediation

Upgrade Mongoose to version 7.23 or later, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA mongoose (cesanta) Fixed in 7.23

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-63626
  2. 2026-10-16 CISA SSVC decision points changed
  3. 2026-10-16 Priority changed: MEDIUM → LOW
  4. 2026-10-16 Priority changed: LOW → MEDIUM
  5. 2026-10-16 Affected versions changed · Red Hat
  6. 2026-10-16 CVSS score added · Red Hat

References

Other 3

  • TI-2023-23198 Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability… CVSS 3.1CRITICAL 9.8
  • TI-2026-51393 Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling CVSS 3.1CRITICAL 9.1
  • TI-2018-15418 Mongoose Web Server 6.9 Denial of Service via Socket Connection CVSS 4.0HIGH 8.7
  • TI-2026-51389 Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching CVSS 4.0CRITICAL 9.1
  • TI-2023-02723 Cesanta Mongoose MQTT Message Parsing Heap Overflow CVSS 3.1HIGH 8.8
  • TI-2020-15865 Buffer overflow in mg_resolve_from_hosts_file in Mongoose 6.18, when reading from a crafted hosts file. CVSS 3.1HIGH 8.8
See all 154 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences