CVE-2022-25299

CVE-2022-25299 affects the cesanta/mongoose package before 7.6. The root cause is unsafe handling of file names during upload via mg_http_upload(), which may allow attackers to write files to arbitrary locations outside the designated target folder. No remediation details are provided in the conn...

CVE-2019-12951

CVE-2019-12951 affects Cesanta Mongoose prior to 6.15. The vulnerability is a heap-based buffer overflow in the parse_mqtt() function (mg_mqtt.c) that can corrupt memory and enable crashes or potential exploitation. The issue is triggered by handling crafted MQTT inputs and is documented as a cri...

CVE-2023-34188

CVE-2023-34188 affects the Mongoose HTTP server prior to 7.10. The issue arises when the server processes requests with negative Content-Length headers, causing an infinite loop as the payload is reparsed and preventing handling of other requests. Remediation is to upgrade to 7.10 or later (as ci...

CVE-2025-65502

CVE-2025-65502 affects Cesanta Mongoose before 7.2. The root cause is a null pointer dereference in add_ca_certs() during TLS initialization when SSL_CTX_get_cert_store() returns NULL, allowing a remote attacker to cause a denial of service over the network. The vulnerability is documented across...