CVE-2026-11404: Out-of-bounds Read in Cesanta Mongoose
Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function mg_tls_server_recv_hello(), which uses an attacker-controlled session_id_len byte from a TLS ClientHello as a buffer index without validating it against the length of received data. A remote, unauthenticated attacker can send a single crafted ClientHello with an oversized session id length to read past the receive buffer, crashing any HTTPS, MQTTS, or WSS service built on MG_TLS_BUILTIN.
AI Analysis
Technical Summary
CVE-2026-11404 is an out-of-bounds read vulnerability in Cesanta Mongoose before version 7.22. The issue arises in the mg_tls_server_recv_hello() function, which processes TLS ClientHello messages. The vulnerability is due to lack of validation of the session_id_len byte, which is attacker-controlled, used as a buffer index. This allows a remote unauthenticated attacker to send a malformed ClientHello with an oversized session id length, triggering a read beyond the buffer boundary and causing a crash of services relying on MG_TLS_BUILTIN TLS implementation, including HTTPS, MQTTS, and WSS.
Potential Impact
A remote unauthenticated attacker can cause a denial-of-service condition by crashing services that use the vulnerable TLS server function. This affects HTTPS, MQTTS, and WSS services built on MG_TLS_BUILTIN in Cesanta Mongoose versions prior to 7.22. There is no indication of information disclosure or code execution, only a crash via out-of-bounds read.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider disabling MG_TLS_BUILTIN or using alternative TLS implementations if feasible to mitigate risk.
CVE-2026-11404: Out-of-bounds Read in Cesanta Mongoose
Description
Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function mg_tls_server_recv_hello(), which uses an attacker-controlled session_id_len byte from a TLS ClientHello as a buffer index without validating it against the length of received data. A remote, unauthenticated attacker can send a single crafted ClientHello with an oversized session id length to read past the receive buffer, crashing any HTTPS, MQTTS, or WSS service built on MG_TLS_BUILTIN.
CVSS v4.0
Score 8.7high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-11404 is an out-of-bounds read vulnerability in Cesanta Mongoose before version 7.22. The issue arises in the mg_tls_server_recv_hello() function, which processes TLS ClientHello messages. The vulnerability is due to lack of validation of the session_id_len byte, which is attacker-controlled, used as a buffer index. This allows a remote unauthenticated attacker to send a malformed ClientHello with an oversized session id length, triggering a read beyond the buffer boundary and causing a crash of services relying on MG_TLS_BUILTIN TLS implementation, including HTTPS, MQTTS, and WSS.
Potential Impact
A remote unauthenticated attacker can cause a denial-of-service condition by crashing services that use the vulnerable TLS server function. This affects HTTPS, MQTTS, and WSS services built on MG_TLS_BUILTIN in Cesanta Mongoose versions prior to 7.22. There is no indication of information disclosure or code execution, only a crash via out-of-bounds read.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, consider disabling MG_TLS_BUILTIN or using alternative TLS implementations if feasible to mitigate risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-06-05T17:46:47.767Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4fbf4768715ace439fdd00
Added to database: 07/09/2026, 15:33:27 UTC
Last enriched: 07/09/2026, 15:48:56 UTC
Last updated: 07/09/2026, 21:16:10 UTC
Views: 14
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.