Cesanta vulnerabilities
46 CVEs and advisories name Cesanta as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-115473Mongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c)
- CVE-2026-63626Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6)
- CVE-2026-73261Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connection
- CVE-2026-73260Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser
- CVE-2026-73252Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAX
- CVE-2026-101003Cesanta Mongoose MQTT Broker main.c fn stack-based overflow
- CVE-2026-86716Cesanta mJS mjs_tok.c skip_spaces_and_comments heap-based overflow
- CVE-2026-73253Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching
- CVE-2026-73255Mongoose: Path traversal in SSI #include directives enables arbitrary file read
- CVE-2026-73259Mongoose: Reflected XSS via decoded URI in directory listing render
- CVE-2026-73256Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE
- CVE-2026-73254Mongoose: Stored XSS via unescaped filenames in directory listing
- CVE-2026-73258Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart
- CVE-2026-73251Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification
- CVE-2026-73257Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling
- CVE-2026-11404Cesanta Mongoose Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID Parsing
- CVE-2026-6986Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verification
- CVE-2026-6985Cesanta Mongoose TCP Option net_builtin.c handle_opt infinite loop
- CVE-2026-5246Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization
- CVE-2026-5245Cesanta Mongoose mDNS Record mongoose.c handle_mdns_record stack-based overflow
- CVE-2026-5244Cesanta Mongoose TLS 1.3 mongoose.c mg_tls_recv_cert heap-based overflow
- CVE-2018-25193Mongoose Web Server 6.9 Denial of Service via Socket Connection
- CVE-2026-2968Cesanta Mongoose Poly1305 Authentication Tag tls_chacha20.c mg_chacha20_poly1305_decrypt signature verification
- CVE-2026-2967Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of source
- CVE-2026-2966Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values
- CVE-2025-0696A NULL Pointer Dereference vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the component embe
- CVE-2025-0695An Allocation of Resources Without Limits or Throttling vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce
- CVE-2024-42392Improper Neutralization of Delimiters in Mongoose Web Server library
- CVE-2024-42391Use of Out-of-range Pointer Offset in Mongoose Web Server library
- CVE-2024-42390Use of Out-of-range Pointer Offset in Mongoose Web Server library