CVE-2026-11404 is an out-of-bounds read vulnerability in Cesanta Mongoose before version 7.22. The vulnerability exists in the mg_tls_server_recv_hello() function, which processes TLS ClientHello messages. It uses the session_id_len byte from the ClientHello as a buffer index without proper validation against the received data length. This allows a remote attacker to send a malicious ClientHello with an oversized session id length, triggering an out-of-bounds read that can crash services relying on MG_TLS_BUILTIN such as HTTPS, MQTTS, or WSS. The vulnerability is remotely exploitable without authentication.

A remote, unauthenticated attacker can cause a denial-of-service by crashing any HTTPS, MQTTS, or WSS service built on the affected versions of Cesanta Mongoose using MG_TLS_BUILTIN. The out-of-bounds read leads to memory access violations resulting in service crashes. There is no indication of information disclosure or code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling MG_TLS_BUILTIN or using alternative TLS implementations if feasible to mitigate exposure. Monitor vendor channels for updates regarding patches or official mitigations.