# cve.now: Cesanta

The newest entries naming Cesanta as an affected vendor (up to 200), of 46 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-115473](https://cve.now/CVE-2026-115473.md): Mongoose: Heap OOB reads and null-byte bypass in mg\_path\_is\_sane (util.c) (CVSS 6.5)
- [CVE-2026-63626](https://cve.now/CVE-2026-63626.md): Mongoose: ppp\_handle\_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG\_ENABLE\_IPV6) (CVSS 8.8)
- [CVE-2026-73261](https://cve.now/CVE-2026-73261.md): Mongoose: handle\_opt() missing opts\[1\] \> len check — 1-byte OOB read corrupts TCP MSS, silences mg\_send() per connection (CVSS 7.5)
- [CVE-2026-73260](https://cve.now/CVE-2026-73260.md): Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser (CVSS 7.5)
- [CVE-2026-73252](https://cve.now/CVE-2026-73252.md): Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg\_tls\_recv\_record() underflows recv\_len to SIZE\_MAX (CVSS 7.5)
- [CVE-2026-101003](https://cve.now/CVE-2026-101003.md): Cesanta Mongoose MQTT Broker main.c fn stack-based overflow (CVSS 6.9)
- [CVE-2026-86716](https://cve.now/CVE-2026-86716.md): Cesanta mJS mjs\_tok.c skip\_spaces\_and\_comments heap-based overflow (CVSS 6.9)
- [CVE-2026-73253](https://cve.now/CVE-2026-73253.md): Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching (CVSS 9.1)
- [CVE-2026-73255](https://cve.now/CVE-2026-73255.md): Mongoose: Path traversal in SSI #include directives enables arbitrary file read (CVSS 6.5)
- [CVE-2026-73259](https://cve.now/CVE-2026-73259.md): Mongoose: Reflected XSS via decoded URI in directory listing render (CVSS 5.4)
- [CVE-2026-73256](https://cve.now/CVE-2026-73256.md): Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE (CVSS 9.1)
- [CVE-2026-73254](https://cve.now/CVE-2026-73254.md): Mongoose: Stored XSS via unescaped filenames in directory listing (CVSS 5.4)
- [CVE-2026-73258](https://cve.now/CVE-2026-73258.md): Mongoose: Multipart boundary/header scan logic error in mg\_http\_next\_multipart (CVSS 6.5)
- [CVE-2026-73251](https://cve.now/CVE-2026-73251.md): Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification (CVSS 9.3)
- [CVE-2026-73257](https://cve.now/CVE-2026-73257.md): Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling (CVSS 9.1)
- [CVE-2026-11404](https://cve.now/CVE-2026-11404.md): Cesanta Mongoose Out-of-Bounds Read in MG\_TLS\_BUILTIN ClientHello Session ID Parsing (CVSS 8.7)
- [CVE-2026-6986](https://cve.now/CVE-2026-6986.md): Cesanta Mongoose GCM Authentication Tag tls\_aes128.c mg\_aes\_gcm\_decrypt signature verification (CVSS 6.3)
- [CVE-2026-6985](https://cve.now/CVE-2026-6985.md): Cesanta Mongoose TCP Option net\_builtin.c handle\_opt infinite loop (CVSS 6.9)
- [CVE-2026-5246](https://cve.now/CVE-2026-5246.md): Cesanta Mongoose P-384 Public Key mongoose.c mg\_tls\_verify\_cert\_signature authorization (CVSS 6.3)
- [CVE-2026-5245](https://cve.now/CVE-2026-5245.md): Cesanta Mongoose mDNS Record mongoose.c handle\_mdns\_record stack-based overflow (CVSS 6.3)
- [CVE-2026-5244](https://cve.now/CVE-2026-5244.md): Cesanta Mongoose TLS 1.3 mongoose.c mg\_tls\_recv\_cert heap-based overflow (CVSS 6.9)
- [CVE-2018-25193](https://cve.now/CVE-2018-25193.md): Mongoose Web Server 6.9 Denial of Service via Socket Connection (CVSS 8.7)
- [CVE-2026-2968](https://cve.now/CVE-2026-2968.md): Cesanta Mongoose Poly1305 Authentication Tag tls\_chacha20.c mg\_chacha20\_poly1305\_decrypt signature verification (CVSS 6.3)
- [CVE-2026-2967](https://cve.now/CVE-2026-2967.md): Cesanta Mongoose TCP Sequence Number net\_builtin.c getpeer verification of source (CVSS 6.3)
- [CVE-2026-2966](https://cve.now/CVE-2026-2966.md): Cesanta Mongoose DNS Transaction ID dns.c mg\_sendnsreq random values (CVSS 6.3)
- [CVE-2025-0696](https://cve.now/CVE-2025-0696.md): A NULL Pointer Dereference vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the component embe (CVSS 5.3)
- [CVE-2025-0695](https://cve.now/CVE-2025-0695.md): An Allocation of Resources Without Limits or Throttling vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce (CVSS 5.3)
- [CVE-2024-42392](https://cve.now/CVE-2024-42392.md): Improper Neutralization of Delimiters in Mongoose Web Server library (CVSS 4.0)
- [CVE-2024-42391](https://cve.now/CVE-2024-42391.md): Use of Out-of-range Pointer Offset in Mongoose Web Server library (CVSS 4.3)
- [CVE-2024-42390](https://cve.now/CVE-2024-42390.md): Use of Out-of-range Pointer Offset in Mongoose Web Server library (CVSS 4.3)
- [CVE-2024-42389](https://cve.now/CVE-2024-42389.md): Use of Out-of-range Pointer Offset in Mongoose Web Server library (CVSS 5.3)
- [CVE-2024-42388](https://cve.now/CVE-2024-42388.md): Use of Out-of-range Pointer Offset in Mongoose Web Server library (CVSS 5.3)
- [CVE-2024-42387](https://cve.now/CVE-2024-42387.md): Use of Out-of-range Pointer Offset in Mongoose Web Server library (CVSS 5.3)
- [CVE-2024-42386](https://cve.now/CVE-2024-42386.md): Use of Out-of-range Pointer Offset in Mongoose Web Server library (CVSS 8.2)
- [CVE-2024-42385](https://cve.now/CVE-2024-42385.md): Improper Neutralization of Delimiters in Mongoose Web Server library (CVSS 4.0)
- [CVE-2024-42384](https://cve.now/CVE-2024-42384.md): Integer Overflow or Wraparound in Mongoose Web Server library (CVSS 7.5)
- [CVE-2024-42383](https://cve.now/CVE-2024-42383.md): Use of Out-of-range Pointer Offset in Mongoose Web Server library (CVSS 4.2)
- [CVE-2023-2905](https://cve.now/CVE-2023-2905.md): Cesanta Mongoose MQTT Message Parsing Heap Overflow (no CVSS)
- [CVE-2017-2922](https://cve.now/CVE-2017-2922.md): An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8. (CVSS 9.8)
- [CVE-2017-2921](https://cve.now/CVE-2017-2921.md): An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8. (CVSS 8.1)
- [CVE-2017-2909](https://cve.now/CVE-2017-2909.md): An infinite loop programming error exists in the DNS server functionality of Cesanta Mongoose 6.8 library. (CVSS 7.5)
- [CVE-2017-2895](https://cve.now/CVE-2017-2895.md): An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. (CVSS 8.2)
- [CVE-2017-2894](https://cve.now/CVE-2017-2894.md): An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. (CVSS 9.8)
- [CVE-2017-2893](https://cve.now/CVE-2017-2893.md): An exploitable NULL pointer dereference vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. (CVSS 7.5)
- [CVE-2017-2892](https://cve.now/CVE-2017-2892.md): An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. (CVSS 9.8)
- [CVE-2017-2891](https://cve.now/CVE-2017-2891.md): An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8. (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/cesanta
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.