CVE-2024-42386: CWE-823 Use of Out-of-range Pointer Offset in Cesanta Mongoose Web Server

This vulnerability (CWE-823) in Cesanta Mongoose Web Server (<=7.14) arises from improper handling of pointer offsets when processing TLS packets. An attacker can send a specially crafted TLS packet that causes the server to access memory out of bounds, resulting in a segmentation fault and application crash. The CVSS 3.1 base score is 8.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and high availability impact.

Successful exploitation causes a denial of service condition by crashing the Mongoose Web Server application due to segmentation faults. There is no direct confidentiality loss, but the server's availability is significantly impacted. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published as of the data provided. Users should monitor Cesanta's advisories for updates and consider mitigating exposure by limiting access to the affected service until a fix is available.