CVE-2026-63626: CWE-122: Heap-based Buffer Overflow in cesanta mongoose
Description
CVE-2026-63626 is a heap-based buffer overflow vulnerability in the cesanta mongoose embedded web server and network library. It occurs in the ppp_handle_ipv6cp() function prior to version 7.23, where the IPv6CP length field is not properly validated against the received payload size. An unauthenticated adjacent peer on a PPP or PPPoE link can exploit this by sending a malformed Configure-Request with an oversized length, leading to out-of-bounds reads and writes in memory buffers. This can result in memory corruption, information disclosure, or denial of service. The issue is fixed in mongoose version 7.23.
CVSS v3.1
Score 8.8high
Affected software
cesanta
mongoose
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Mongoose versions prior to 7.23 contain a heap-based buffer overflow vulnerability (CWE-122) in the ppp_handle_ipv6cp() function located in src/l2_ppp.c. The function trusts the 16-bit IPv6CP length field without verifying it against the actual received payload size. When MG_ENABLE_TCPIP and MG_ENABLE_IPV6 are enabled on a PPP or PPPoE link, an unauthenticated adjacent peer can complete the LCP exchange and send a Configure-Request with an oversized length field. This causes the ppp_tx_frame() function to read beyond the recv_queue buffer and write beyond the tx buffer, potentially exposing adjacent heap memory or causing the event loop to hang via the find_opt() function. The vulnerability is resolved in mongoose version 7.23.
Potential Impact
Successful exploitation allows an unauthenticated adjacent attacker to cause heap-based buffer overflows, leading to potential arbitrary code execution, information disclosure of adjacent heap memory, or denial of service by hanging the event loop. The CVSS 3.1 score is 8.8 (high severity), reflecting high impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Upgrade to mongoose version 7.23 or later, where this vulnerability is fixed. No other mitigations are indicated by the vendor advisory. Patch status is confirmed fixed in 7.23.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-17T14:11:15.481Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6acfceae2cdf04f656a1f7e2
Added to database: 10/14/2026, 18:49:18 UTC
Last enriched: 10/14/2026, 19:03:17 UTC
Last updated: 10/14/2026, 19:08:27 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.