CVE-2026-73261 Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connection

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MGENABLETCPIP in src/netbuiltin.c does not reject a TCP option whose declared opts1 length exceeds the remaining option bytes. In handleopt, a NOP followed by a truncated MSS option causes...

CVE-2026-73260

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MGTLSBUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mgdertotlv and mgdernext, a peer-controlled length can advance t...

CVE-2026-73260

The Mongoose embedded web server and network library is vulnerable to an out-of-bounds read due to a length-counter underflow in its built-in TLS X.509 DER parser (prior to version 7.23 ). Specifically, the functions mg_der_to_tlv() and mg_der_next() fail to verify if a long-form DER element leng...

CVE-2026-73260

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MGTLSBUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mgdertotlv and mgdernext, a peer-controlled length can advance t...

CVE-2026-73260 Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MGTLSBUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mgdertotlv and mgdernext, a peer-controlled length can advance t...

EUVD-2026-101597

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MGTLSBUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mgdertotlv and mgdernext, a peer-controlled length can advance t...

CVE-2026-73260 Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MGTLSBUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mgdertotlv and mgdernext, a peer-controlled length can advance t...

CVE-2026-73252 Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAX

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MGTLSBUILTIN in src/tlsbuiltin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no plaintext or ContentType byte. In mgtlsrecvrecord, the msgsz...

CVE-2026-73252 Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAX

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MGTLSBUILTIN in src/tlsbuiltin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no plaintext or ContentType byte. In mgtlsrecvrecord, the msgsz...

CVE-2026-73252

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MGTLSBUILTIN in src/tlsbuiltin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no plaintext or ContentType byte. In mgtlsrecvrecord, the msgsz...

CVE-2026-73252 Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAX

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MGTLSBUILTIN in src/tlsbuiltin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no plaintext or ContentType byte. In mgtlsrecvrecord, the msgsz...

CVE-2026-73252

The Mongoose embedded web server and network library (prior to version 7.23 ) contains an unauthenticated remote heap out-of-bounds read vulnerability in its built-in TLS stack. The root cause is an off-by-one length check in mg_tls_recv_record() within src/tls_builtin.c, which allows a TLS 1.3 r...

EUVD-2026-101596

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MGTLSBUILTIN in src/tlsbuiltin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no plaintext or ContentType byte. In mgtlsrecvrecord, the msgsz...

CVE-2026-73252

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MGTLSBUILTIN in src/tlsbuiltin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no plaintext or ContentType byte. In mgtlsrecvrecord, the msgsz...

kali-rpi-luks-crypt

Full disk encryption for Kali on Raspberry or other similar architecture using LUKS This HOWTO is dedicated to running Kali on Raspberry or other similar architecture, e.g. ODROID-C2 using full disk encryption with LUKS. Based on the little bit outdated document here. Motivation Deploying Kali on...

CVE-2026-55167

Versions of LDAP Account Manager prior to 9.6 are vulnerable to a flaw where the WebAuthn authentication challenge is retained within the PHP session after the authentication response is processed. This allows a user who has completed valid password authentication to reuse the same signed WebAuth...

CVE-2026-55167 LDAP Account Manager: WebAuthn authentication challenge is kept in the PHP session

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authentication response is processed. A user who...

CVE-2026-55167

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authentication response is processed. A user who...

EUVD-2026-101595

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authentication response is processed. A user who...

CVE-2026-55167

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP session after the authentication response is processed. A user who...