CVE-2019-13503

Technical details about CVE-2019-13503 are not present in the connected documents. The initial description notes a heap-based buffer over-read in Mongoose 6.15. Monitor for updates and consult official CVE records for specifics.

CVE-2026-73259

CVE-2026-73259 is a reflected cross-site scripting (XSS) vulnerability in Mongoose , an embedded web server and network library, affecting versions prior to 7.22 . The flaw resides in the mg_http_serve_dir() and listdir() functions in src/http.c, which insert a percent-decoded request URI into th...

CVE-2019-12951

CVE-2019-12951 affects Cesanta Mongoose prior to 6.15. The vulnerability is a heap-based buffer overflow in the parse_mqtt() function (mg_mqtt.c) that can corrupt memory and enable crashes or potential exploitation. The issue is triggered by handling crafted MQTT inputs and is documented as a cri...

CVE-2022-25299

CVE-2022-25299 affects the cesanta/mongoose package before 7.6. The root cause is unsafe handling of file names during upload via mg_http_upload(), which may allow attackers to write files to arbitrary locations outside the designated target folder. No remediation details are provided in the conn...

CVE-2021-26529

The CVE-2021-26529 issue affects Cesanta Mongoose HTTPS server (versions 7.0 and 6.7–6.18 compiled with mbedTLS). The root cause is an out-of-bounds write in mg_tls_init triggered by a connection request after memory pool exhaustion, enabling a remote write condition. Documents indicate this is a...

CVE-2023-34188

CVE-2023-34188 affects the Mongoose HTTP server prior to 7.10. The issue arises when the server processes requests with negative Content-Length headers, causing an infinite loop as the payload is reparsed and preventing handling of other requests. Remediation is to upgrade to 7.10 or later (as ci...

CVE-2017-2921

Cesanta Mongoose 6.8 Websocket implementation contains a memory corruption flaw in websocket frame handling. During parsing, an integer overflow in data_len/frame_len calculations can cause a large, misvalidated memory write in mg_deliver_websocket_data, leading to a heap-buffer-overflow. Reporte...

CVE-2019-19307

CVE-2019-19307 affects Cesanta Mongoose 6.16. The vulnerability is an integer overflow in the parse_mqtt function in mongoose.c that can be triggered by a crafted MQTT protocol packet, leading to remote denial of service (infinite loop) and possibly an out-of-bounds write. Reports from multiple s...

CVE-2023-2905

CVE-2023-2905 affects Cesanta Mongoose (embedded web server). The vulnerability is a heap-based buffer overflow caused by not validating the length of MQTT_CMD_PUBLISH parsed messages with a variable-length header in version 7.10. Versions 7.9 and earlier are not affected; the issue is resolved i...

CVE-2017-2891

Cesanta Mongoose 6.8 is affected by a use-after-free vulnerability in its HTTP server CGI handling. In this CVE, an ordinary HTTP POST targeting a CGI script can cause a previously freed mg_connection structure to be dereferenced later in mg_cgi_ev_handler, potentially enabling remote code execut...

CVE-2021-26528

The CVE-2021-26528 issue affects Cesanta Mongoose HTTP server (7.0) where the function mg_http_serve_file is vulnerable to a remote OOB write after the memory pool is exhausted. This is documented as a high-severity (CVSS v3.1: 9.1, CRITICAL) network-facing vulnerability with potential impact to ...

CVE-2017-2892

The CVE-2017-2892 entry affects Cesanta Mongoose 6.8, with an exploitable vulnerability in the MQTT packet parsing path. A specially crafted MQTT packet can trigger an out-of-bounds memory read/write, enabling information disclosure, denial of service, and potentially remote code execution. Publi...

CVE-2024-42384

CVE-2024-42384 affects Cesanta Mongoose Web Server, version 7.14. The issue is an Integer Overflow or Wraparound in the server, enabling an attacker to send an unexpected TLS packet and cause a segmentation fault in the application. Documents consistently describe the vulnerability as impacting M...

CVE-2021-26530

CVE-2021-26530 describes a vulnerability in Cesanta Mongoose HTTPS server 7.0 when compiled with OpenSSL. The vulnerable component is the mg_tls_init function, which allows a remote out-of-bounds write via a connection request after the memory pool is exhausted. The Connected documents confirm th...

CVE-2024-42383

The CVE-2024-42383 entry concerns Cesanta Mongoose Web Server v7.14. The vulnerability is described as an Out-of-range Pointer Offset that lets an attacker write a NULL byte beyond the memory space allocated for the hostname field. NVD lists CVSS v3.1 base score 9.8 (CRITICAL) with network attack...

CVE-2024-42388

CVE-2024-42388 affects Cesanta Mongoose Web Server (library) v7.14. The vulnerability is described as an Out-of-range Pointer Offset that can cause an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space. Public documents consistently reference ...

CVE-2017-2894

CVE-2017-2894 describes an exploitable stack buffer overflow in Cesanta Mongoose 6.8, specifically in the MQTT SUBSCRIBE handling. The root cause is in mg_mqtt_broker_handle_subscribe where a fixed-size qoss buffer (512) is filled without bounds checks, allowing a SUBSCRIBE packet with many topic...

CVE-2024-42389

CVE-2024-42389 affects Cesanta Mongoose Web Server, specifically v7.14. The issue is described as an Out-of-range Pointer Offset vulnerability that can be triggered by a crafted TLS packet, causing the application to read unintended heap memory. The NVD entry lists a CVSSv3.1 base score of 5.3 (M...

CVE-2017-2895

The CVE-2017-2895 issue affects Cesanta Mongoose 6.8 in its MQTT SUBSCRIBE packet parsing. The root cause is a missing bounds check when parsing topic length (topic->len read from the packet) before using it to locate the QoS byte, enabling an out-of-bounds read from the message payload. This ...

CVE-2024-42387

CVE-2024-42387 concerns Cesanta Mongoose Web Server, version 7.14. The vulnerability arises from an out-of-range pointer offset in the library, which may allow an attacker to send an unexpected TLS packet and cause the application to read unintended heap memory space. Documents consistently descr...

CVE-2018-10945

CVE-2018-10945 affects Mongoose 6.11, where the mg_handle_cgi function in mongoose.c can be triggered by an HTTP request to cause a denial of service via a heap-based buffer over-read or NULL pointer dereference (related to mbuf_insert). Multiple sources (OSV, RH, OpenVAS listings) describe a DoS...

CVE-2018-18764

CVE-2018-18764 : Cesanta Mongoose 6.13 contains a heap-based buffer over-read in the MQTT packet-parsing function (parse_mqtt getu16). A specially crafted MQTT SUBSCRIBE packet over the network can trigger an arbitrary out-of-bounds memory read, potentially leading to information disclosure and d...

CVE-2024-42392

CVE-2024-42392 affects Cesanta Mongoose Web Server library (v7.14 and possibly earlier) with an Improper Neutralization of Delimiters flaw that can trigger an infinite loop when input strings contain unexpected characters. The NVD/NVD-derived note and Red Hat and CVE records describe this vulnera...

CVE-2017-2909

CVE-2017-2909 affects Cesanta Mongoose 6.8 library’s DNS server functionality. A crafted DNS query/response can trigger an infinite loop in DNS name compression handling, causing high CPU usage and a Denial of Service when sent over the network. Connected advisories describe the issue but do not ...

CVE-2024-42386

CVE-2024-42386 affects Cesanta Mongoose Web Server library (v7.14). The vulnerability is described as an out-of-range pointer offset issue that allows an attacker to send an unexpected TLS packet and cause a segmentation fault in the application. The available connected sources confirm the affect...

CVE-2017-2922

CVE-2017-2922 affects Cesanta Mongoose 6.8 (Websocket protocol handling). A memory corruption via fragmented WebSocket frames can trigger a use-after-free when reassembling data in mg_deliver_websocket_data, due to a buffer resize that invalidates pointers and leads to reads/writes on freed memor...

CVE-2024-42390

CVE-2024-42390 concerns Cesanta Mongoose Web Server, specifically version 7.14. The vulnerability stems from an out-of-range pointer offset that can cause the server to process a malicious TLS packet and read unintended heap memory space. Documents consistently describe the affected component as ...

CVE-2024-42391

Cesanta Mongoose Web Server v7.14 is affected by CVE-2024-42391 due to an out-of-range pointer offset in the TLS handling, which may allow an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space. The issue is documented across multiple sources (...

CVE-2017-2893

CVE-2017-2893 affects Cesanta Mongoose 6.8 (MQTT server component). The vulnerability is a NULL pointer dereference in the MQTT SUBSCRIBE handling path (mg_mqtt_broker_handle_subscribe) caused by dereferencing an uninitialized or NULL session pointer (nc->user_data) when processing SUBSCRIBE t...

CVE-2024-42385

CVE-2024-42385 affects Cesanta Mongoose Web Server v7.14. The root cause is improper neutralization of delimiters, which can trigger an out-of-bounds memory write if a PEM certificate contains unexpected characters. PT-Security confirms the affected version and recommends updating to a newer rele...

CVE-2026-73257

Mongoose versions before 7.22 allow CL.TE request smuggling: mg_http_parse() and http_cb() in src/http.c accept both Content-Length and Transfer-Encoding: chunked headers, prioritizing chunked encoding while a Content-Length-preferring reverse proxy uses a different boundary, enabling injected re...

CVE-2018-20355

The CVE-2018-20355 issue affects Cesanta Mongoose Embedded Web Server Library 6.13 and earlier. A use-after-free in mg_http_free_proto_data_cgi within mongoose.c leads to an invalid write of 8 bytes, enabling either application crash (DoS) or remote code execution. The vulnerability details indic...

CVE-2026-2968

Cesanta Mongoose up to 7.20 is affected in mg_chacha20_poly1305_decrypt (tls_chacha20.c, Poly1305 Authentication Tag Handler). The issue is improper verification of the cryptographic signature, with a remote attack vector. Descriptions indicate high complexity for exploitation and that the exploi...

CVE-2018-20354

The CVE-2018-20354 issue affects Cesanta Mongoose Embedded Web Server Library (versions 6.13 and earlier). A use-after-free in mg_http_get_proto_data during a return causes an invalid read of 8 bytes, leading to denial of service (crash) or remote code execution. NVD data shows high/critical impa...

CVE-2020-25756

CVE-2020-25756 affects Cesanta Mongoose 6.18, with a buffer overflow in the mg_get_http_header function caused by missing bounds checking. This can be triggered by crafting an HTTP header and, per the sources, is tied to high-severity potential (NVD CVSS v3.1: CRITICAL; v2: HIGH) with network exp...

CVE-2018-19587

CVE-2018-19587 affects Cesanta Mongoose 6.13, with a SIGSEGV reported in the mqtt session handling code (mongoose.c: mg_mqtt_add_session()). The connected sources confirm the affected product and function, but do not provide a public-facing exploit path or remediation steps. CVSS data from NVD in...

CVE-2018-18765

The CVE-2018-18765 entry concerns Cesanta Mongoose 6.13, where the MQTT packet-parsing function mg_mqtt_next_subscribe_topic is affected by a heap-based buffer over-read. This vulnerability allows an attacker to trigger an arbitrary out-of-bounds memory read over the network via a crafted MQTT SU...

CVE-2018-20353

The CVE affects Cesanta Mongoose Embedded Web Server Library, versions 6.13 and earlier, where a use-after-free causes an invalid read of 8 bytes in mg_http_get_proto_data. This vulnerability can lead to a denial of service (application crash) or remote code execution. No exploitation details are...

CVE-2018-20356

CVE-2018-20356 — affected software: Cesanta Mongoose Embedded Web Server Library (

CVE-2020-25887

CVE-2020-25887 affects Cesanta Mongoose (v6.18) with a buffer overflow in the function mg_resolve_from_hosts_file when parsing a crafted hosts file. The issue is rooted in that host-resolution path, leading to potential memory corruption. The CVSS 3.1 base score is 8.8 (HIGH) with network attack ...

CVE-2026-73253

Mongoose (embedded web server and network library) prior to version 7.22 is vulnerable to a TLS hostname verification bypass . The root cause is in mg_tls_verify_cert_san() and mg_tls_verify_cert_cn() (in src/tls_builtin.c), which call mg_match() — a function whose wildcard matching can cross DNS...

CVE-2025-51495

The Mongoose web framework (versions 7.5 through 7.17 ) contains an integer overflow vulnerability within its WebSocket component. Specifically, the mg_ws_cb function fails to properly handle certain WebSocket frames, where a client-sent request can set ofs=0. This causes an integer overflow duri...

CVE-2026-73256

Mongoose (an embedded web server and network library by cesanta) prior to 7.22 is vulnerable to HTTP request smuggling via chunked Transfer-Encoding. The root cause is a logic error in http_cb() in src/http.c: it tests hm.proto.len with an impossible greater-than-eight condition, so is_http_1_0 i...

CVE-2026-73255

CVE-2026-73255 is a path traversal vulnerability in Mongoose (an embedded web server and network library) prior to version 7.22 . The root cause is in the mg_ssi() function in src/ssi.c , which concatenates the #include or #include virtual directive argument into a filesystem path without calling...

CVE-2026-2966

Cesanta Mongoose

CVE-2025-65502

Cesanta Mongoose versions prior to 7.2 are vulnerable to a null pointer dereference within the add_ca_certs() function. This flaw is triggered during TLS initialization when SSL_CTX_get_cert_store() returns NULL , allowing remote attackers to cause a denial of service . To address this issue, it ...

CVE-2026-2967

The CVE-2026-2967 entry describes a vulnerability in Cesanta Mongoose up to version 7.20, specifically in the getpeer function of /src/net_builtin.c within the TCP Sequence Number Handler. The underlying issue is improper verification of the source of a communication channel, potentially enabling...

CVE-2026-6985

CVE-2026-6985 affects Cesanta Mongoose up to 7.20, specifically the TCP Option Handler’s handle_opt in /src/net_builtin.c. The vulnerability arises from manipulating the argument optlen, which can cause an infinite loop. It is described as remotely exploitable, and an exploit has been made public...

CVE-2026-5244

CVE-2026-5244 affects Cesanta Mongoose

CVE-2026-73251

Mongoose (embedded web server and network library) prior to 7.23 contains a critical TLS certificate verification flaw in src/tls_builtin.c. When a client is configured with a multi-certificate CA bundle, mg_tls_init() stores the bundle in tls->ca_bundle_der while tls->ca_der.len remains ze...