Critical severity9.8NVD Advisory· Published Jun 10, 2019· Updated Jun 17, 2026

CVE-2018-20356

Description

An invalid read of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Cesanta/Mongoose
cpe:2.3:a:cesanta:mongoose:*:*:*:*:*:*:*:*
Range: <=6.13
Cesanta/Mongoose Embedded Web Server Librarydescription
Cesanta/Mongoose Embedded Web Server Libraryllm-fuzzy
Range: <=6.13

Patches

Vulnerability mechanics

References

github.com/insi2304/mongoose-6.13-fuzz/blob/master/Simplest_Web_Server_Use_After_Free-read_mg_http_free_proto_data_cgi.pngnvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000