This vulnerability affects the TCP Option Handler component of Cesanta Mongoose up to version 7.20. Specifically, the handle_opt function in /src/net_builtin.c improperly handles the optlen argument, leading to an infinite loop condition. The vulnerability is remotely exploitable without privileges or user interaction. The vendor has released version 7.21 which addresses this issue. The CVSS 4.0 base score is 6.9 (medium severity), reflecting the network attack vector and low impact on availability.

Successful exploitation results in an infinite loop in the affected component, potentially causing a denial of service by exhausting CPU resources. There is no indication of code execution or data compromise. The vulnerability can be triggered remotely without authentication, increasing the risk of denial of service attacks against systems running vulnerable versions of Cesanta Mongoose.

Upgrade Cesanta Mongoose to version 7.21 or later, as the vendor has confirmed this version fixes the vulnerability. Since the vendor has already addressed the issue, applying this official fix is the recommended remediation. Patch status is confirmed by the vendor advisory.