cbcvebase.
CVE-2026-5244
published 2026-04-02

CVE-2026-5244: A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mongoose.c of the component TLS 1.3…

PriorityP264critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.73%
49.5th percentile
A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mongoose.c of the component TLS 1.3 Handler. Such manipulation of the argument pubkey leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.21 mitigates this issue. The name of the patch is 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Affected

22 ranges
VendorProductVersion rangeFixed in
cesantamongoose——
cesantamongoose——
cesantamongoose——
cesantamongoose——
cesantamongoose——
cesantamongoose——
cesantamongoose——
cesantamongoose——
cesantamongoose——
cesantamongoose——
cesantamongoose——
cesantamongoose——
cesantamongoose——
cesantamongoose——
cesantamongoose——
cesantamongoose——
cesantamongoose——
cesantamongoose——
cesantamongoose——
cesantamongoose——
cesantamongoose——
cesantamongoose>= 7.0 < 7.217.21

Detection & IOCsextracted from sources · hover to see the quote

hash0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1↗
pathmongoose.c↗
  • →Monitor for heap-based buffer overflow conditions triggered via the mg_tls_recv_cert function in mongoose.c during TLS 1.3 handshake processing, specifically through manipulation of the pubkey argument. ↗
  • →The vulnerability is remotely exploitable and a public exploit exists; prioritize detection on network-facing Mongoose-based services using TLS 1.3, particularly versions up to and including 7.20. ↗
  • ·The vulnerability only affects Cesanta Mongoose versions up to 7.20; version 7.21 contains the fix. Ensure deployed instances are identified and version-checked before applying detections. ↗
  • ·The flaw is specific to the TLS 1.3 handler code path; deployments not using TLS 1.3 may not be directly exposed, but scope should be confirmed per environment. ↗
  • ·Fedora package maintainers are required to independently verify whether the flaw affects their specific package build before initiating updates. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.05.5MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.