CVE-2026-63626

A flaw was found in Mongoose. An unauthenticated adjacent attacker can exploit this issue by sending a specially crafted Point-to-Point Protocol PPP packet containing an oversized length field during IPv6 Control Protocol IPv6CP negotiation. This lack of bounds validation causes out-of-bounds...

CVE-2026-63626

Mongoose is an embedded web server and network library. Prior to 7.23, ppphandleipv6cp in src/l2ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MGENABLETCPIP and MGENABLEIPV6, an unauthenticated adjacent peer can complet...

CVE-2026-63626

Built-in TCP/IP PPP IPV6CP option parsing bounds check...

PT-2026-114240

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 7.23 Description The ppp handle ipv6cp function in src/l2 ppp.c trusts the 16-bit IPv6CP length field without verifying it against the received payload size. On a PPP or PPPoE link where MG ENABLE TCPIP and MG ENABLE...