CVE-2026-73260 Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MGTLSBUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mgdertotlv and mgdernext, a peer-controlled length can advance t...

CVE-2026-52055

mgdertotlv long-form DER length OOB read...

CVE-2026-52058

mgdertotlv long-form DER length OOB read...

CVE-2026-52055

mgdertotlv long-form DER length OOB read...

CVE-2026-52058

mgdertotlv long-form DER length OOB read...