Mongoose: Use-after-poison
Affects mongooseSource GCVE Database
Rated by Threat Radar
Data as of 12 Aug 2026, 16:33 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
OSS-Fuzzmongoosepkg:generic/mongooseOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Until an official fix is available, users should monitor for updates from the Mongoose maintainers or OSS-Fuzz reports.
Description
A use-after-poison vulnerability was identified in the rx_ip function of the Mongoose library, reported by OSS-Fuzz. This issue involves accessing memory after it has been invalidated, which can lead to undefined behavior or crashes. The vulnerability affects multiple specific versions of Mongoose from 7.9 through 7.23. No official patch or remediation information is provided in the available data, and there are no known exploits in the wild.