Threat Intelligence Database

CVE-2024-42392 is a medium severity vulnerability in Cesanta Mongoose Web Server version 7.14 and earlier. It involves improper neutralization of delimiters that can cause an infinite loop when the server processes input strings containing unexpected characters. This vulnerability does not impact confidentiality or integrity but can cause a denial of service due to availability disruption. No official patch or remediation guidance is currently available from the vendor. The vulnerability requires high privileges and user interaction to exploit and has no known exploits in the wild.

CVE-2024-42391 is a medium severity vulnerability in Cesanta Mongoose Web Server version 7.14 and earlier. It involves an out-of-range pointer offset triggered by sending an unexpected TLS packet, causing the application to read unintended heap memory. This flaw does not allow privilege escalation or denial of service but may expose limited information from memory. No official patch or remediation guidance is currently available from the vendor.

CVE-2024-42386 is a high-severity vulnerability in Cesanta Mongoose Web Server version 7.14 and earlier. It involves an out-of-range pointer offset that can be triggered by sending an unexpected TLS packet, causing the application to crash with a segmentation fault. This vulnerability does not impact confidentiality but can lead to denial of service by interrupting server availability.

CVE-2024-42385 is a medium severity vulnerability in Cesanta Mongoose Web Server version 7.14 and earlier. It involves improper neutralization of delimiters in PEM certificates, which can trigger an out-of-bound memory write. This flaw could potentially cause denial of service or other availability impacts. No known exploits are reported in the wild, and no official patch or remediation guidance has been provided yet.

CVE-2024-42384 is an integer overflow or wraparound vulnerability in Cesanta Mongoose Web Server version 7.14 and earlier. It allows an attacker to send a specially crafted TLS packet that triggers a segmentation fault in the application, causing a denial of service. The vulnerability does not impact confidentiality or integrity but results in high impact on availability.