High severity7.5NVD Advisory· Published Jun 23, 2023· Updated Jun 17, 2026

CVE-2023-34188

Description

The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Cesanta/Mongoose2 versions
cpe:2.3:a:cesanta:mongoose:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:cesanta:mongoose:*:*:*:*:*:*:*:*range: <7.10
- (no CPE)range: <7.10
Mongoose/Mongoosedescription

Patches

Vulnerability mechanics

References

github.com/cesanta/mongoose/commit/4663090a8fb036146dfe77718cff612b0101cb0fnvdPatch
github.com/cesanta/mongoose/pull/2197nvdPatch
github.com/cesanta/mongoose/compare/7.9...7.10nvdRelease Notes
blog.narfindustries.com/blog/narf-discovers-critical-vulnerabilities-in-cesanta-mongoose-http-servernvd
security.netapp.com/advisory/ntap-20250228-0001/nvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000