CVE-2019-13503

Technical details about CVE-2019-13503 are not present in the connected documents. The initial description notes a heap-based buffer over-read in Mongoose 6.15. Monitor for updates and consult official CVE records for specifics.

CVE-2022-25299

CVE-2022-25299 affects the cesanta/mongoose package before 7.6. The root cause is unsafe handling of file names during upload via mg_http_upload(), which may allow attackers to write files to arbitrary locations outside the designated target folder. No remediation details are provided in the conn...

CVE-2019-12951

CVE-2019-12951 affects Cesanta Mongoose prior to 6.15. The vulnerability is a heap-based buffer overflow in the parse_mqtt() function (mg_mqtt.c) that can corrupt memory and enable crashes or potential exploitation. The issue is triggered by handling crafted MQTT inputs and is documented as a cri...

CVE-2017-2921

Cesanta Mongoose 6.8 Websocket implementation contains a memory corruption flaw in websocket frame handling. During parsing, an integer overflow in data_len/frame_len calculations can cause a large, misvalidated memory write in mg_deliver_websocket_data, leading to a heap-buffer-overflow. Reporte...

CVE-2023-34188

CVE-2023-34188 affects the Mongoose HTTP server prior to 7.10. The issue arises when the server processes requests with negative Content-Length headers, causing an infinite loop as the payload is reparsed and preventing handling of other requests. Remediation is to upgrade to 7.10 or later (as ci...

CVE-2021-26529

The CVE-2021-26529 issue affects Cesanta Mongoose HTTPS server (versions 7.0 and 6.7–6.18 compiled with mbedTLS). The root cause is an out-of-bounds write in mg_tls_init triggered by a connection request after memory pool exhaustion, enabling a remote write condition. Documents indicate this is a...

CVE-2017-2891

Cesanta Mongoose 6.8 is affected by a use-after-free vulnerability in its HTTP server CGI handling. In this CVE, an ordinary HTTP POST targeting a CGI script can cause a previously freed mg_connection structure to be dereferenced later in mg_cgi_ev_handler, potentially enabling remote code execut...

CVE-2019-19307

CVE-2019-19307 affects Cesanta Mongoose 6.16. The vulnerability is an integer overflow in the parse_mqtt function in mongoose.c that can be triggered by a crafted MQTT protocol packet, leading to remote denial of service (infinite loop) and possibly an out-of-bounds write. Reports from multiple s...

CVE-2021-26528

The CVE-2021-26528 issue affects Cesanta Mongoose HTTP server (7.0) where the function mg_http_serve_file is vulnerable to a remote OOB write after the memory pool is exhausted. This is documented as a high-severity (CVSS v3.1: 9.1, CRITICAL) network-facing vulnerability with potential impact to ...

CVE-2017-2894

CVE-2017-2894 describes an exploitable stack buffer overflow in Cesanta Mongoose 6.8, specifically in the MQTT SUBSCRIBE handling. The root cause is in mg_mqtt_broker_handle_subscribe where a fixed-size qoss buffer (512) is filled without bounds checks, allowing a SUBSCRIBE packet with many topic...

CVE-2021-26530

CVE-2021-26530 describes a vulnerability in Cesanta Mongoose HTTPS server 7.0 when compiled with OpenSSL. The vulnerable component is the mg_tls_init function, which allows a remote out-of-bounds write via a connection request after the memory pool is exhausted. The Connected documents confirm th...

CVE-2017-2892

The CVE-2017-2892 entry affects Cesanta Mongoose 6.8, with an exploitable vulnerability in the MQTT packet parsing path. A specially crafted MQTT packet can trigger an out-of-bounds memory read/write, enabling information disclosure, denial of service, and potentially remote code execution. Publi...

CVE-2017-2895

The CVE-2017-2895 issue affects Cesanta Mongoose 6.8 in its MQTT SUBSCRIBE packet parsing. The root cause is a missing bounds check when parsing topic length (topic->len read from the packet) before using it to locate the QoS byte, enabling an out-of-bounds read from the message payload. This ...

CVE-2017-2922

CVE-2017-2922 affects Cesanta Mongoose 6.8 (Websocket protocol handling). A memory corruption via fragmented WebSocket frames can trigger a use-after-free when reassembling data in mg_deliver_websocket_data, due to a buffer resize that invalidates pointers and leads to reads/writes on freed memor...

CVE-2023-2905

CVE-2023-2905 affects Cesanta Mongoose (embedded web server). The vulnerability is a heap-based buffer overflow caused by not validating the length of MQTT_CMD_PUBLISH parsed messages with a variable-length header in version 7.10. Versions 7.9 and earlier are not affected; the issue is resolved i...

CVE-2017-2909

CVE-2017-2909 affects Cesanta Mongoose 6.8 library’s DNS server functionality. A crafted DNS query/response can trigger an infinite loop in DNS name compression handling, causing high CPU usage and a Denial of Service when sent over the network. Connected advisories describe the issue but do not ...

CVE-2018-10945

CVE-2018-10945 affects Mongoose 6.11, where the mg_handle_cgi function in mongoose.c can be triggered by an HTTP request to cause a denial of service via a heap-based buffer over-read or NULL pointer dereference (related to mbuf_insert). Multiple sources (OSV, RH, OpenVAS listings) describe a DoS...

CVE-2018-18764

CVE-2018-18764 : Cesanta Mongoose 6.13 contains a heap-based buffer over-read in the MQTT packet-parsing function (parse_mqtt getu16). A specially crafted MQTT SUBSCRIBE packet over the network can trigger an arbitrary out-of-bounds memory read, potentially leading to information disclosure and d...

CVE-2024-42383

The CVE-2024-42383 entry concerns Cesanta Mongoose Web Server v7.14. The vulnerability is described as an Out-of-range Pointer Offset that lets an attacker write a NULL byte beyond the memory space allocated for the hostname field. NVD lists CVSS v3.1 base score 9.8 (CRITICAL) with network attack...

CVE-2024-42392

CVE-2024-42392 affects Cesanta Mongoose Web Server library (v7.14 and possibly earlier) with an Improper Neutralization of Delimiters flaw that can trigger an infinite loop when input strings contain unexpected characters. The NVD/NVD-derived note and Red Hat and CVE records describe this vulnera...

CVE-2024-42387

CVE-2024-42387 concerns Cesanta Mongoose Web Server, version 7.14. The vulnerability arises from an out-of-range pointer offset in the library, which may allow an attacker to send an unexpected TLS packet and cause the application to read unintended heap memory space. Documents consistently descr...

CVE-2017-2893

CVE-2017-2893 affects Cesanta Mongoose 6.8 (MQTT server component). The vulnerability is a NULL pointer dereference in the MQTT SUBSCRIBE handling path (mg_mqtt_broker_handle_subscribe) caused by dereferencing an uninitialized or NULL session pointer (nc->user_data) when processing SUBSCRIBE t...

CVE-2024-42384

CVE-2024-42384 affects Cesanta Mongoose Web Server, version 7.14. The issue is an Integer Overflow or Wraparound in the server, enabling an attacker to send an unexpected TLS packet and cause a segmentation fault in the application. Documents consistently describe the vulnerability as impacting M...

CVE-2024-42388

CVE-2024-42388 affects Cesanta Mongoose Web Server (library) v7.14. The vulnerability is described as an Out-of-range Pointer Offset that can cause an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space. Public documents consistently reference ...

CVE-2024-42389

CVE-2024-42389 affects Cesanta Mongoose Web Server, specifically v7.14. The issue is described as an Out-of-range Pointer Offset vulnerability that can be triggered by a crafted TLS packet, causing the application to read unintended heap memory. The NVD entry lists a CVSSv3.1 base score of 5.3 (M...

CVE-2024-42386

CVE-2024-42386 affects Cesanta Mongoose Web Server library (v7.14). The vulnerability is described as an out-of-range pointer offset issue that allows an attacker to send an unexpected TLS packet and cause a segmentation fault in the application. The available connected sources confirm the affect...

CVE-2024-42390

CVE-2024-42390 concerns Cesanta Mongoose Web Server, specifically version 7.14. The vulnerability stems from an out-of-range pointer offset that can cause the server to process a malicious TLS packet and read unintended heap memory space. Documents consistently describe the affected component as ...

CVE-2024-42385

CVE-2024-42385 affects Cesanta Mongoose Web Server v7.14. The root cause is improper neutralization of delimiters, which can trigger an out-of-bounds memory write if a PEM certificate contains unexpected characters. PT-Security confirms the affected version and recommends updating to a newer rele...

CVE-2024-42391

Cesanta Mongoose Web Server v7.14 is affected by CVE-2024-42391 due to an out-of-range pointer offset in the TLS handling, which may allow an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space. The issue is documented across multiple sources (...

CVE-2018-20355

The CVE-2018-20355 issue affects Cesanta Mongoose Embedded Web Server Library 6.13 and earlier. A use-after-free in mg_http_free_proto_data_cgi within mongoose.c leads to an invalid write of 8 bytes, enabling either application crash (DoS) or remote code execution. The vulnerability details indic...

CVE-2018-20354

The CVE-2018-20354 issue affects Cesanta Mongoose Embedded Web Server Library (versions 6.13 and earlier). A use-after-free in mg_http_get_proto_data during a return causes an invalid read of 8 bytes, leading to denial of service (crash) or remote code execution. NVD data shows high/critical impa...

CVE-2018-20356

CVE-2018-20356 — affected software: Cesanta Mongoose Embedded Web Server Library (

CVE-2020-25756

CVE-2020-25756 affects Cesanta Mongoose 6.18, with a buffer overflow in the mg_get_http_header function caused by missing bounds checking. This can be triggered by crafting an HTTP header and, per the sources, is tied to high-severity potential (NVD CVSS v3.1: CRITICAL; v2: HIGH) with network exp...

CVE-2018-19587

CVE-2018-19587 affects Cesanta Mongoose 6.13, with a SIGSEGV reported in the mqtt session handling code (mongoose.c: mg_mqtt_add_session()). The connected sources confirm the affected product and function, but do not provide a public-facing exploit path or remediation steps. CVSS data from NVD in...

CVE-2018-20353

The CVE affects Cesanta Mongoose Embedded Web Server Library, versions 6.13 and earlier, where a use-after-free causes an invalid read of 8 bytes in mg_http_get_proto_data. This vulnerability can lead to a denial of service (application crash) or remote code execution. No exploitation details are...

CVE-2018-18765

The CVE-2018-18765 entry concerns Cesanta Mongoose 6.13, where the MQTT packet-parsing function mg_mqtt_next_subscribe_topic is affected by a heap-based buffer over-read. This vulnerability allows an attacker to trigger an arbitrary out-of-bounds memory read over the network via a crafted MQTT SU...

CVE-2020-25887

CVE-2020-25887 affects Cesanta Mongoose (v6.18) with a buffer overflow in the function mg_resolve_from_hosts_file when parsing a crafted hosts file. The issue is rooted in that host-resolution path, leading to potential memory corruption. The CVSS 3.1 base score is 8.8 (HIGH) with network attack ...

CVE-2025-65502

CVE-2025-65502 affects Cesanta Mongoose before 7.2. The root cause is a null pointer dereference in add_ca_certs() during TLS initialization when SSL_CTX_get_cert_store() returns NULL, allowing a remote attacker to cause a denial of service over the network. The vulnerability is documented across...

CVE-2025-51495

CVE-2025-51495 affects the WebSocket component of Mongoose versions 7.5 through 7.17 . A vulnerability in the WebSocket handling can trigger an integer overflow when processing a specially crafted request, potentially causing the application to crash (denial of service). In cases where downstream...

CVE-2026-2967

The CVE-2026-2967 entry describes a vulnerability in Cesanta Mongoose up to version 7.20, specifically in the getpeer function of /src/net_builtin.c within the TCP Sequence Number Handler. The underlying issue is improper verification of the source of a communication channel, potentially enabling...

CVE-2026-5245

Cesanta Mongoose up to 7.20 contains a stack-based buffer overflow in the function handle_mdns_record (mongoose.c, mDNS Record Handler) caused by manipulation of the buf argument. Remote exploitation is possible; the exploit is described as difficult with a high attack complexity. A fixed version...

CVE-2026-5244

CVE-2026-5244 affects Cesanta Mongoose

CVE-2026-2968

Cesanta Mongoose up to 7.20 is affected in mg_chacha20_poly1305_decrypt (tls_chacha20.c, Poly1305 Authentication Tag Handler). The issue is improper verification of the cryptographic signature, with a remote attack vector. Descriptions indicate high complexity for exploitation and that the exploi...

CVE-2026-5246

CVEs details (CVE-2026-5246) : Affects Cesanta Mongoose up to version 7.20. The vulnerability is in the function mg_tls_verify_cert_signature (mongoose.c) within the P-384 Public Key Handler. Remote exploitation could lead to an authorization bypass. Exploitation is described as complex, and ther...

CVE-2026-2966

Cesanta Mongoose

CVE-2026-6985

CVE-2026-6985 affects Cesanta Mongoose up to 7.20, specifically the TCP Option Handler’s handle_opt in /src/net_builtin.c. The vulnerability arises from manipulating the argument optlen, which can cause an infinite loop. It is described as remotely exploitable, and an exploit has been made public...

CVE-2026-6986

CVE-2026-6986 affects Cesanta Mongoose up to version 7.20. The vulnerability is in mg_aes_gcm_decrypt (src/tls_aes128.c, GCM Authentication Tag Handler) and leads to improper verification of the cryptographic signature. Attack could be remote; described as high complexity with exploitability asse...