CVE-2026-73260

A flaw was found in Mongoose. The built-in Transport Layer Security TLS certificate parser fails to verify that element lengths fit within the remaining certificate buffer, leading to an out-of-bounds memory read. An unauthenticated remote attacker can exploit this vulnerability by presenting a...

CVE-2026-73260

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MGTLSBUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mgdertotlv and mgdernext, a peer-controlled length can advance t...

CVE-2026-73260: Out-of-bounds Read

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MGTLSBUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mgdertotlv and mgdernext, a peer-controlled length can advance t...

Security Bulletin: IBM MQ queue manager is vulnerable to denial of service (CVE-2026-12150)

Summary IBM MQ has addressed an unbounded recursion vulnerability in the queue manager's TLS certificate parser that could allow a remote unauthenticated attacker with a valid TLS certificate to cause a denial of service Vulnerability Details CVEID:CVE-2026-12150 DESCRIPTION: IBM MQ could allow a...

PT-2026-114267

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 7.23 Description The built-in TLS certificate parser used by MG TLS BUILTIN does not verify if a long-form DER Distinguished Encoding Rules element length fits within the remaining certificate buffer. In the function...