This vulnerability (CWE-140) in Cesanta Mongoose Web Server versions up to 7.14 allows an attacker with high privileges and user interaction to trigger an infinite loop by supplying input strings with unexpected characters. The flaw stems from improper neutralization of delimiters in input processing, leading to a denial of service condition. The CVSS 3.1 base score is 4.0, reflecting a local attack vector with high attack complexity and privileges required, causing availability impact only. No vendor advisory or patch is currently available, and no known exploits have been reported.

The vulnerability can cause an infinite loop in the web server, resulting in denial of service (availability impact). There is no impact on confidentiality or integrity. Exploitation requires local access with high privileges and user interaction, limiting the attack surface. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected versions and monitor for unusual behavior that could indicate attempts to trigger the infinite loop. Avoid processing untrusted input with unexpected delimiters where possible.