Vulnerabilities

TI-2026-85225 CVE-2026-115473

Out-of-bounds reads in Mongoose mg_path_is_sane path check

HIGH 68

Mongoose is an embedded web server and network library.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00264 Published 2026-11-04 Fixed in 7.22 CWE-125

TI-2026-74439 CVE-2026-63626

Heap overflow and out-of-bounds read in Mongoose PPP IPv6 handling

MEDIUM 40

Mongoose is an embedded web server and network library.

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.00239 Published 2026-10-14 Fixed in 7.23 CWE-122

TI-2026-74442 CVE-2026-73261

x

HIGH 72

Mongoose is an embedded web server and network library.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00417 Published 2026-10-14 Fixed in 7.23 CWE-125

TI-2026-74441 CVE-2026-73260

Out-of-bounds read in Mongoose built-in TLS certificate parser

HIGH 72

Mongoose is an embedded web server and network library.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0023 Published 2026-10-14 Fixed in 7.23 CWE-125

TI-2026-74440 CVE-2026-73252

Heap out-of-bounds read in Mongoose built-in TLS stack

HIGH 72

Mongoose is an embedded web server and network library.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00376 Published 2026-10-14 Fixed in 7.23 CWE-125

TI-2026-65050 CVE-2026-101003 · GHSA-g7gm-388f-77vf

Cesanta Mongoose MQTT Broker main.c fn stack-based overflow

LOW 37

A weakness has been identified in Cesanta Mongoose up to 7.21.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00462 Published 2026-09-28 Fixed in 7.22 CWE-119

TI-2026-59274 CVE-2026-86716 · GHSA-mcxw-v86m-vj8g

Cesanta mJS mjs_tok.c skip_spaces_and_comments heap-based overflow

HIGH 70

A vulnerability was determined in Cesanta mJS up to 1.26.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0057 Published 2026-09-08 No fix listed CWE-119

TI-2026-51389 CVE-2026-73253

Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching

HIGH 74

Mongoose is an embedded web server and network library.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00344 Published 2026-08-20 Fixed in 7.22 CWE-295

TI-2026-51391 CVE-2026-73255

Mongoose: Path traversal in SSI #include directives enables arbitrary file read

MEDIUM 62

Mongoose is an embedded web server and network library.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00657 Published 2026-08-20 Fixed in 7.22 CWE-22

TI-2026-51395 CVE-2026-73259

Mongoose: Reflected XSS via decoded URI in directory listing render

MEDIUM 58

Mongoose is an embedded web server and network library.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00408 Published 2026-08-20 Fixed in 7.22 CWE-79

TI-2026-51392 CVE-2026-73256

Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE

MEDIUM 48

Mongoose is an embedded web server and network library.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00439 Published 2026-08-20 Fixed in 7.22 CWE-444

TI-2026-51390 CVE-2026-73254

Mongoose: Stored XSS via unescaped filenames in directory listing

MEDIUM 58

Mongoose is an embedded web server and network library.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00344 Published 2026-08-20 Fixed in 7.22 CWE-79

TI-2026-51394 CVE-2026-73258

Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart

HIGH 68

Mongoose is an embedded web server and network library.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00459 Published 2026-08-20 Fixed in 7.22 CWE-697

TI-2026-51388 CVE-2026-73251

Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification

MEDIUM 47

Mongoose is an embedded web server and network library.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00193 Published 2026-08-20 Fixed in 7.23 CWE-295

TI-2026-51393 CVE-2026-73257

Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling

HIGH 80

Mongoose is an embedded web server and network library.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00673 Published 2026-08-20 Fixed in 7.22 CWE-444

TI-2026-09841 CVE-2026-11404 · GHSA-cvgj-gr8r-q762

Cesanta Mongoose Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID Parsing

MEDIUM 45

Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function mg_tls_server_recv_hello(), which uses an attacker-controlled session_id_len byte from a TLS ClientHello as a buffer index w…

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00784 Published 2026-07-09 Fixed in 7.22 CWE-125

TI-2026-06114 CVE-2026-6986 · GHSA-p5j9-fjff-qrmr

Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verification

MEDIUM 61

A security vulnerability has been detected in Cesanta Mongoose up to 7.20.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00217 Published 2026-04-25 Fixed in 7.21 CWE-345

TI-2026-06113 CVE-2026-6985 · GHSA-3ppf-435x-3p66

Cesanta Mongoose TCP Option net_builtin.c handle_opt infinite loop

HIGH 70

A weakness has been identified in Cesanta Mongoose up to 7.20.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00565 Published 2026-04-25 Fixed in 7.21 CWE-404

TI-2026-04582 CVE-2026-5246 · GHSA-hm7q-jq63-pr78

Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization

MEDIUM 61

A vulnerability was determined in Cesanta Mongoose up to 7.20.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00647 Published 2026-04-02 Fixed in 7.21 CWE-285

TI-2026-04581 CVE-2026-5245 · GHSA-2rqj-7x75-2684

Cesanta Mongoose mDNS Record mongoose.c handle_mdns_record stack-based overflow

LOW 29

A vulnerability was found in Cesanta Mongoose up to 7.20.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00729 Published 2026-04-02 Fixed in 7.21 CWE-119

TI-2026-04580 CVE-2026-5244 · GHSA-7vfw-f3r2-9m2j

Cesanta Mongoose TLS 1.3 mongoose.c mg_tls_recv_cert heap-based overflow

LOW 38

A vulnerability has been found in Cesanta Mongoose up to 7.20.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00755 Published 2026-04-02 Fixed in 7.21 CWE-119

TI-2018-15418 CVE-2018-25193 · GHSA-hm6q-f5fc-rh9v

Mongoose Web Server 6.9 Denial of Service via Socket Connection

HIGH 77

Mongoose Web Server 6.9 contains a denial of service vulnerability that allows remote attackers to crash the service by establishing multiple socket connections.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00386 Published 2026-03-06 No fix listed CWE-1188

TI-2026-02560 CVE-2026-2968 · GHSA-jprc-mg35-68jq

Cesanta Mongoose Poly1305 Authentication Tag tls_chacha20.c mg_chacha20_poly1305_decrypt signature verification

MEDIUM 61

A vulnerability was detected in Cesanta Mongoose up to 7.20.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00254 Published 2026-02-23 No fix listed CWE-345

TI-2026-02559 CVE-2026-2967 · GHSA-c6h3-vh8h-r8mj

Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of source

MEDIUM 61

A security vulnerability has been detected in Cesanta Mongoose up to 7.20.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00575 Published 2026-02-23 No fix listed CWE-940

TI-2026-02558 CVE-2026-2966 · GHSA-m5mm-h952-fxjj

Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values

MEDIUM 61

A weakness has been identified in Cesanta Mongoose up to 7.20.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00441 Published 2026-02-23 No fix listed CWE-310

Vulnerabilities

Filters