Mongoose
Products
2- 6 CVEs
- 2 CVEs
Recent CVEs
8| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-11567 | Hig | 0.61 | 8.8 | 0.04 | Sep 7, 2017 | Cross-site request forgery (CSRF) vulnerability in Mongoose Web Server before 6.9 allows remote attackers to hijack the authentication of users for requests that modify Mongoose.conf via a request to __mg_admin?save. NOTE: this issue can be leveraged to execute arbitrary code… | ||
| CVE-2020-25887 | Hig | 0.57 | 8.8 | 0.01 | Aug 22, 2023 | Buffer overflow in mg_resolve_from_hosts_file in Mongoose 6.18, when reading from a crafted hosts file. | ||
| CVE-2024-53900 | Cri | 0.52 | 9.1 | 0.04 | Dec 2, 2024 | Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. | ||
| CVE-2018-25193 | Hig | 0.49 | 7.5 | 0.00 | Mar 6, 2026 | Mongoose Web Server 6.9 contains a denial of service vulnerability that allows remote attackers to crash the service by establishing multiple socket connections. Attackers can repeatedly create connections to the default port and send malformed data to exhaust server resources… | ||
| CVE-2025-51495 | Hig | 0.00 | 7.5 | 0.00 | Sep 29, 2025 | An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17. By sending a specially crafted WebSocket request, an attacker can cause the application to crash. If downstream vendors integrate this component improperly, the issue may lead to a… | ||
| CVE-2023-34188 | Hig | 0.00 | 7.5 | 0.01 | Jun 23, 2023 | The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other… | ||
| CVE-2019-13503 | Hig | 0.00 | 7.5 | 0.01 | Jul 11, 2019 | mq_parse_http in mongoose.c in Mongoose 6.15 has a heap-based buffer over-read. | ||
| CVE-2019-12951 | Cri | 0.00 | 9.8 | 0.02 | Jun 24, 2019 | An issue was discovered in Mongoose before 6.15. The parse_mqtt() function in mg_mqtt.c has a critical heap-based buffer overflow. |
- risk 0.61cvss 8.8epss 0.04
Cross-site request forgery (CSRF) vulnerability in Mongoose Web Server before 6.9 allows remote attackers to hijack the authentication of users for requests that modify Mongoose.conf via a request to __mg_admin?save. NOTE: this issue can be leveraged to execute arbitrary code…
- risk 0.57cvss 8.8epss 0.01
Buffer overflow in mg_resolve_from_hosts_file in Mongoose 6.18, when reading from a crafted hosts file.
- risk 0.52cvss 9.1epss 0.04
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.
- risk 0.49cvss 7.5epss 0.00
Mongoose Web Server 6.9 contains a denial of service vulnerability that allows remote attackers to crash the service by establishing multiple socket connections. Attackers can repeatedly create connections to the default port and send malformed data to exhaust server resources…
- risk 0.00cvss 7.5epss 0.00
An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17. By sending a specially crafted WebSocket request, an attacker can cause the application to crash. If downstream vendors integrate this component improperly, the issue may lead to a…
- risk 0.00cvss 7.5epss 0.01
The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other…
- risk 0.00cvss 7.5epss 0.01
mq_parse_http in mongoose.c in Mongoose 6.15 has a heap-based buffer over-read.
- risk 0.00cvss 9.8epss 0.02
An issue was discovered in Mongoose before 6.15. The parse_mqtt() function in mg_mqtt.c has a critical heap-based buffer overflow.