TI-2026-51389 CVE-2026-73253
Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching
Priority HIGH 74
Mongoose is an embedded web server and network library.
Vulnerabilities
55 records
TI-2026-51391 CVE-2026-73255
Mongoose: Path traversal in SSI #include directives enables arbitrary file read
Priority MEDIUM 62
Mongoose is an embedded web server and network library.
Priority MEDIUM 58
Mongoose is an embedded web server and network library.
TI-2026-51392 CVE-2026-73256
Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE
Priority MEDIUM 48
Mongoose is an embedded web server and network library.
Priority MEDIUM 58
Mongoose is an embedded web server and network library.
TI-2026-51394 CVE-2026-73258
Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart
Priority HIGH 68
Mongoose is an embedded web server and network library.
TI-2026-51388 CVE-2026-73251
Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification
Priority MEDIUM 47
Mongoose is an embedded web server and network library.
TI-2026-51393 CVE-2026-73257
Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling
Priority HIGH 80
Mongoose is an embedded web server and network library.
TI-2026-06114 CVE-2026-6986 · GHSA-p5j9-fjff-qrmr
Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verification
Priority MEDIUM 61
A security vulnerability has been detected in Cesanta Mongoose up to 7.20.
TI-2026-06113 CVE-2026-6985 · GHSA-3ppf-435x-3p66
Cesanta Mongoose TCP Option net_builtin.c handle_opt infinite loop
Priority HIGH 70
A weakness has been identified in Cesanta Mongoose up to 7.20.
TI-2026-04582 CVE-2026-5246 · GHSA-hm7q-jq63-pr78
Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization
Priority MEDIUM 61
A vulnerability was determined in Cesanta Mongoose up to 7.20.
TI-2026-04581 CVE-2026-5245 · GHSA-2rqj-7x75-2684
Cesanta Mongoose mDNS Record mongoose.c handle_mdns_record stack-based overflow
Priority LOW 29
A vulnerability was found in Cesanta Mongoose up to 7.20.
TI-2026-04580 CVE-2026-5244 · GHSA-7vfw-f3r2-9m2j
Cesanta Mongoose TLS 1.3 mongoose.c mg_tls_recv_cert heap-based overflow
Priority LOW 38
A vulnerability has been found in Cesanta Mongoose up to 7.20.
TI-2026-02560 CVE-2026-2968 · GHSA-jprc-mg35-68jq
Cesanta Mongoose Poly1305 Authentication Tag tls_chacha20.c mg_chacha20_poly1305_decrypt signature verification
Priority MEDIUM 61
A vulnerability was detected in Cesanta Mongoose up to 7.20.
TI-2026-02559 CVE-2026-2967 · GHSA-c6h3-vh8h-r8mj
Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of source
Priority MEDIUM 61
A security vulnerability has been detected in Cesanta Mongoose up to 7.20.
TI-2026-02558 CVE-2026-2966 · GHSA-m5mm-h952-fxjj
Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values
Priority MEDIUM 61
A weakness has been identified in Cesanta Mongoose up to 7.20.
TI-2025-40378 CVE-2025-65502 · GHSA-hp7w-j9mx-8vpj
Null pointer dereference in add_ca_certs() in Cesanta Mongoose before 7.2 allows remote…
Priority LOW 20
Null pointer dereference in add_ca_certs() in Cesanta Mongoose before 7.2 allows remote attackers to cause a denial of service via TLS initialization where SSL_CTX_get_cert_store() returns NULL.
TI-2025-32347 CVE-2025-51495 · GHSA-83rc-g55p-8xj2
An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru…
Priority HIGH 66
An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17.
TI-2024-28376 CVE-2024-42392 · GHSA-xqwp-cfr5-f9gr
Improper Neutralization of Delimiters in Mongoose Web Server library
Priority LOW 32
Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an infinite loop bug if the input string contains unexpected characters.
TI-2024-28375 CVE-2024-42391 · GHSA-29wp-p54c-r4v7
Use of Out-of-range Pointer Offset in Mongoose Web Server library
Priority LOW 24
Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.
TI-2024-28374 CVE-2024-42390 · GHSA-wgw9-vmg5-8928
Use of Out-of-range Pointer Offset in Mongoose Web Server library
Priority LOW 24
Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.
TI-2024-28373 CVE-2024-42389 · GHSA-wp87-pj42-93xr
Use of Out-of-range Pointer Offset in Mongoose Web Server library
Priority LOW 30
Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.
TI-2024-28372 CVE-2024-42388 · GHSA-vqm5-gf2r-4jjf
Use of Out-of-range Pointer Offset in Mongoose Web Server library
Priority LOW 30
Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.
TI-2024-28371 CVE-2024-42387 · GHSA-g34v-qr57-mvrm
Use of Out-of-range Pointer Offset in Mongoose Web Server library
Priority LOW 32
Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.
TI-2024-28370 CVE-2024-42386 · GHSA-gjfh-x4fj-rg67
Use of Out-of-range Pointer Offset in Mongoose Web Server library
Priority MEDIUM 42
Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentation fault on the application.