VYPR

Mongoose

by Cesanta

Source repositories

CVEs (57)

  • CVE-2026-73256CriAug 20, 2026
    risk 0.52cvss 9.1epss 0.00

    Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http_cb() function in src/http.c tests…

  • CVE-2026-73253CriAug 20, 2026
    risk 0.52cvss —epss 0.00

    Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mg_tls_verify_cert_san() and…

  • CVE-2017-2893HigNov 7, 2017
    risk 0.51cvss 7.5epss 0.25

    An exploitable NULL pointer dereference vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. An MQTT SUBSCRIBE packet can cause a NULL pointer dereference leading to server crash and denial of service. An attacker needs to send a specially…

  • CVE-2024-35492HigMay 29, 2024
    risk 0.49cvss 7.5epss 0.01

    Cesanta Mongoose commit b316989 was discovered to contain a NULL pointer dereference via the scpy function at src/fmt.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MQTT packet.

  • CVE-2018-10945HigJun 19, 2018
    risk 0.49cvss 7.5epss 0.01

    The mg_handle_cgi function in mongoose.c in Mongoose 6.11 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash, or NULL pointer dereference) via an HTTP request, related to the mbuf_insert function.

  • CVE-2017-2909HigNov 7, 2017
    risk 0.49cvss 7.5epss 0.01

    An infinite loop programming error exists in the DNS server functionality of Cesanta Mongoose 6.8 library. A specially crafted DNS request can cause an infinite loop resulting in high CPU usage and Denial Of Service. An attacker can send a packet over the network to trigger this…

  • CVE-2024-42386HigNov 18, 2024
    risk 0.46cvss 8.2epss 0.00

    Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentation fault on the application.

  • CVE-2026-11404HigJul 9, 2026
    risk 0.42cvss 7.5epss 0.01

    Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function mg_tls_server_recv_hello(), which uses an attacker-controlled session_id_len byte from a TLS ClientHello as a buffer index without validating it against the length of received data. A…

  • CVE-2024-42384HigNov 18, 2024
    risk 0.42cvss 7.5epss 0.00

    Integer Overflow or Wraparound vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentation fault on the application.

  • CVE-2018-19587MedNov 27, 2018
    risk 0.42cvss 6.5epss 0.01

    In Cesanta Mongoose 6.13, a SIGSEGV exists in the mongoose.c mg_mqtt_add_session() function.

  • CVE-2026-5244HigApr 2, 2026
    risk 0.41cvss 7.3epss 0.01

    A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mongoose.c of the component TLS 1.3 Handler. Such manipulation of the argument pubkey leads to heap-based buffer overflow. The attack may be launched remotely.…

  • CVE-2026-73258MedAug 20, 2026
    risk 0.35cvss 6.5epss 0.00

    Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mg_http_next_multipart() in src/http.c. The loops comparing s[b] and s[b + 1], and s[h2] and s[h2 + 1], use an…

  • CVE-2026-73255MedAug 20, 2026
    risk 0.35cvss 6.5epss 0.01

    Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an #include file or #include virtual directive. The mg_ssi() function in src/ssi.c concatenates the directive…

  • CVE-2024-42389MedNov 18, 2024
    risk 0.34cvss 5.3epss 0.00

    Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.

  • CVE-2024-42388MedNov 18, 2024
    risk 0.34cvss 5.3epss 0.00

    Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.

  • CVE-2024-42387MedNov 18, 2024
    risk 0.34cvss 5.3epss 0.00

    Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.

  • CVE-2026-5246MedApr 2, 2026
    risk 0.29cvss 5.6epss 0.01

    A vulnerability was determined in Cesanta Mongoose up to 7.20. Affected is the function mg_tls_verify_cert_signature of the file mongoose.c of the component P-384 Public Key Handler. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely.…

  • CVE-2026-5245MedApr 2, 2026
    risk 0.29cvss 5.6epss 0.01

    A vulnerability was found in Cesanta Mongoose up to 7.20. This impacts the function handle_mdns_record of the file mongoose.c of the component mDNS Record Handler. Performing a manipulation of the argument buf results in stack-based buffer overflow. Remote exploitation of the…

  • CVE-2026-73259MedAug 20, 2026
    risk 0.28cvss 5.4epss 0.00

    Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MG_ENABLE_DIRLIST and persuade a user to visit it. The mg_http_serve_dir() and listdir() path in src/http.c places the…

  • CVE-2026-73254MedAug 20, 2026
    risk 0.28cvss 5.4epss 0.00

    Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MG_ENABLE_DIRLIST. The printdirentry() path called by…