CVE-2026-63626 is a heap-based buffer overflow vulnerability in the cesanta mongoose embedded web server and network library. The flaw exists in the ppp_handle_ipv6cp() function prior to version 7.23, where it improperly trusts the 16-bit IPv6CP length field without validating it against the actual payload size. This can allow an unauthenticated adjacent peer on a PPP or PPPoE link to send a malformed Configure-Request with an oversized length, leading to out-of-bounds reads and writes in memory buffers. The issue can also cause exposure of adjacent heap memory or hang the event loop. The vulnerability is fixed in version 7.23.
CVE-2026-73261 is a high-severity vulnerability in the cesanta mongoose embedded web server and network library. Versions prior to 7.23 have an improper input validation issue in the built-in TCP/IP stack, where the length of TCP options is not properly checked. This allows an unauthenticated remote peer to corrupt the per-connection Maximum Segment Size (MSS) value, causing subsequent data transmissions to be truncated or zero-length while the TCP connection remains otherwise healthy. The vulnerability is fixed in mongoose version 7.23.
Mongoose versions prior to 7.23 contain an out-of-bounds read vulnerability in the built-in TLS certificate parser. This occurs because the parser fails to verify that a long-form DER element length fits within the remaining certificate buffer, allowing a peer-controlled length to cause invalid memory access during TLS handshake. An unauthenticated malicious TLS server or a client presenting a certificate can trigger this, resulting in denial of service. The issue is fixed in version 7.23.
CVE-2026-73252 is an integer underflow vulnerability in the cesanta mongoose embedded web server's built-in TLS stack prior to version 7.23. The flaw allows a malicious TLS peer to send a specially crafted TLS 1.3 record that triggers a heap out-of-bounds read before certificate or Finished validation, causing a remote denial of service. This occurs because the length calculation underflows, leading to processing of stale buffer contents as trusted data. The issue is fixed in version 7.23.
CVE-2026-101003 is a stack-based buffer overflow vulnerability in Cesanta Mongoose versions 7.0 through 7.21. It affects the MQTT Broker component, specifically the function 'fn' in the file tutorials/mqtt/mqtt-server/main.c. The vulnerability can be exploited remotely without authentication or user interaction. A public exploit is available. Upgrading to version 7.22 resolves this issue.
A vulnerability was determined in Cesanta mJS up to 1.26. Affected is the function skip_spaces_and_comments of the file src/mjs_tok.c. Executing a manipulation can lead to heap-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mg_tls_verify_cert_san() and mg_tls_verify_cert_cn() functions in src/tls_builtin.c call mg_match(), whose wildcard can cross DNS label boundaries, so a pattern such as *.example.com can match foo.bar.example.com. The resulting hostname verification bypass permits interception and modification of TLS traffic. This issue is fixed in version 7.22.
CVE-2026-73255 is a path traversal vulnerability in the cesanta mongoose embedded web server and network library. Versions prior to 7.22 allow an attacker who can control an SSI-enabled file to include directory traversal sequences in #include directives. This leads to disclosure of files readable by the Mongoose process due to improper sanitization of the file path. The issue is fixed in version 7.22.
Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MG_ENABLE_DIRLIST and persuade a user to visit it. The mg_http_serve_dir() and listdir() path in src/http.c places the decoded request URI into the title and h1 elements without HTML entity encoding. The resulting reflected cross-site scripting executes in the Mongoose origin and can expose session data or perform actions as the victim. This issue is fixed in version 7.22.
Mongoose, an embedded web server and network library, has a critical HTTP request smuggling vulnerability (CVE-2026-73256) affecting versions prior to 7.22. The flaw arises from inconsistent handling of HTTP/1.0 requests with Transfer-Encoding: chunked headers, allowing remote unauthenticated attackers to bypass proxy protections. This can lead to unauthorized access or state changes. The issue is fixed in version 7.22.
CVE-2026-73254 is a stored cross-site scripting (XSS) vulnerability in the cesanta mongoose embedded web server and network library. The flaw exists in versions prior to 7.22 when directory listing is enabled (MG_ENABLE_DIRLIST). An attacker who can create a file with an HTML payload in its filename can cause the server to inject this raw filename into the HTML link text without proper neutralization, leading to script execution in the user's browser. This can expose session data or allow actions to be performed as the victim. The issue is fixed in version 7.22.
Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mg_http_next_multipart() in src/http.c. The loops comparing s[b] and s[b + 1], and s[h2] and s[h2 + 1], use an incorrect AND condition and stop when either character resembles part of a CRLF terminator. This truncates headers, filenames, or boundaries and can cause an application to accept dangerous content after seeing a misleading Content-Type value. This issue is fixed in version 7.22.
Mongoose is an embedded web server and network library. Prior to 7.23, a network attacker can impersonate a TLS server to a Mongoose client configured with a multi-certificate CA bundle. In src/tls_builtin.c, the mg_tls_init() function stores the bundle in tls->ca_bundle_der while tls->ca_der.len remains zero, and mg_tls_recv_cert() uses tls_bundle_find() to accept a Common Name match without calling mg_tls_verify_cert_signature(). A forged self-signed certificate can therefore satisfy hostname and CertificateVerify checks and enable interception, credential disclosure, traffic modification, and malicious responses. This issue is fixed in version 7.23.
Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_http_parse() and http_cb() paths in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy can use a different request boundary. This CL.TE desynchronization can inject requests that access or modify resources in another user context. This issue is fixed in version 7.22.
Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function mg_tls_server_recv_hello(), which uses an attacker-controlled session_id_len byte from a TLS ClientHello as a buffer index without validating it against the length of received data. A remote, unauthenticated attacker can send a single crafted ClientHello with an oversized session id length to read past the receive buffer, crashing any HTTPS, MQTTS, or WSS service built on MG_TLS_BUILTIN.
A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This issue affects the function mg_aes_gcm_decrypt of the file /src/tls_aes128.c of the component GCM Authentication Tag Handler. Such manipulation leads to improper verification of cryptographic signature. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 7.21 is capable of addressing this issue. It is advisable to upgrade the affected component. VulDB has contacted the vendor early and they confirmed quickly, that this issue got fixed already.
A weakness has been identified in Cesanta Mongoose up to 7.20. This vulnerability affects the function handle_opt of the file /src/net_builtin.c of the component TCP Option Handler. This manipulation of the argument optlen causes infinite loop. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 7.21 is able to resolve this issue. Upgrading the affected component is advised. VulDB has contacted the vendor early and they confirmed quickly, that this issue got fixed already.
CVE-2026-5246 is an authorization bypass vulnerability in Cesanta Mongoose versions up to 7.20. It affects the mg_tls_verify_cert_signature function within the P-384 Public Key Handler component. The vulnerability can be exploited remotely but requires a high level of complexity and skill. The vendor has released version 7.21 to address this issue. The CVSS 4.0 base score is 6.3, indicating a medium severity level.
CVE-2026-5245 is a stack-based buffer overflow vulnerability in the handle_mdns_record function of the mongoose.c file in Cesanta Mongoose versions up to 7.20. This vulnerability allows remote attackers to cause a buffer overflow by manipulating the buf argument. Exploitation is considered difficult and requires a high degree of complexity. The vendor has released version 7.21 to address this issue with an official patch. Users of affected versions should upgrade to the fixed version to mitigate the risk.
CVE-2026-5244 is a heap-based buffer overflow vulnerability in Cesanta Mongoose versions up to 7.20, specifically in the mg_tls_recv_cert function of the TLS 1.3 Handler component. The vulnerability arises from improper handling of the pubkey argument, which can be manipulated remotely to trigger the overflow. A public exploit has been disclosed. The vendor has released version 7.21 to address this issue.