Cesanta Mongoose vulnerabilities

CVE-2018-20354 [CRITICAL] CWE-416 CVE-2018-20354: An invalid read of 8 bytes due to a use-after-free vulnerability during a "return" in the mg_http_ge An invalid read of 8 bytes due to a use-after-free vulnerability during a "return" in the mg_http_get_proto_data function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution.

CVE-2018-18764 [CRITICAL] CWE-125 CVE-2018-18764: An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality o An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in a parse_mqtt getu16 call. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of servic

CVE-2018-18765 [CRITICAL] CWE-125 CVE-2018-18765: An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality o An exploitable arbitrary memory read vulnerability exists in the MQTT packet-parsing functionality of Cesanta Mongoose 6.13. It is a heap-based buffer over-read in mg_mqtt_next_subscribe_topic. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of se

CVE-2021-26529 [CRITICAL] CWE-787 CVE-2021-26529: The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS su The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable to remote OOB write attack via connection request after exhausting memory pool.

CVE-2020-25756 [CRITICAL] CWE-120 CVE-2020-25756: A buffer overflow vulnerability exists in the mg_get_http_header function in Cesanta Mongoose 6.18 d A buffer overflow vulnerability exists in the mg_get_http_header function in Cesanta Mongoose 6.18 due to a lack of bounds checking. A crafted HTTP header can exploit this bug. NOTE: a committer has stated "this will not happen in practice.

CVE-2026-6985 [HIGH] CWE-404 CVE-2026-6985: A weakness has been identified in Cesanta Mongoose up to 7.20. This vulnerability affects the functi A weakness has been identified in Cesanta Mongoose up to 7.20. This vulnerability affects the function handle_opt of the file /src/net_builtin.c of the component TCP Option Handler. This manipulation of the argument optlen causes infinite loop. The attack is possible to be carried out remotely. The exploit has been made available to the public and could

CVE-2019-17426 [CRITICAL] CWE-20 Improper Input Validation in Automattic Mongoose Improper Input Validation in Automattic Mongoose Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a `_bsontype` attribute is ignored. For example, adding `"_bsontype":"a"` can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around this _bsontype special case that exists in older versions of t

CVE-2026-11404 [HIGH] CWE-125 CVE-2026-11404: Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function mg_t Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function mg_tls_server_recv_hello(), which uses an attacker-controlled session_id_len byte from a TLS ClientHello as a buffer index without validating it against the length of received data. A remote, unauthenticated attacker can send a single crafted ClientHello wi

CVE-2024-42383 [CRITICAL] CWE-823 CVE-2024-42383: Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows to writ Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows to write a NULL byte value beyond the memory space dedicated for the hostname field.

CVE-2021-26530 [CRITICAL] CWE-787 CVE-2021-26530: The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 (compiled with OpenSSL support) is vul The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 (compiled with OpenSSL support) is vulnerable to remote OOB write attack via connection request after exhausting memory pool.

CVE-2023-2905 [HIGH] CWE-122 CVE-2023-2905: Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a varia Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web server, version 7.10 is susceptible to a heap-based buffer overflow vulnerability in the default configuration. Version 7.9 and prior does not appear to be vulnerable. This issue is resolved in versio

CVE-2019-12951 [CRITICAL] CWE-787 CVE-2019-12951: An issue was discovered in Mongoose before 6.15. The parse_mqtt() function in mg_mqtt.c has a critic An issue was discovered in Mongoose before 6.15. The parse_mqtt() function in mg_mqtt.c has a critical heap-based buffer overflow.

CVE-2021-26528 [CRITICAL] CWE-787 CVE-2021-26528: The mg_http_serve_file function in Cesanta Mongoose HTTP server 7.0 is vulnerable to remote OOB writ The mg_http_serve_file function in Cesanta Mongoose HTTP server 7.0 is vulnerable to remote OOB write attack via connection request after exhausting memory pool.

CVE-2026-73255 [MEDIUM] CWE-22 CVE-2026-73255: Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control a Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an #include file or #include virtual directive. The mg_ssi() function in src/ssi.c concatenates the directive argument into a filesystem path without calling mg_path_is_sane(), allowing an M

CVE-2022-25299 [HIGH] CWE-552 CVE-2022-25299: This affects the package cesanta/mongoose before 7.6. The unsafe handling of file names during uploa This affects the package cesanta/mongoose before 7.6. The unsafe handling of file names during upload using mg_http_upload() method may enable attackers to write files to arbitrary locations outside the designated target folder.

CVE-2020-25887 [HIGH] CWE-120 CVE-2020-25887: Buffer overflow in mg_resolve_from_hosts_file in Mongoose 6.18, when reading from a crafted hosts fi Buffer overflow in mg_resolve_from_hosts_file in Mongoose 6.18, when reading from a crafted hosts file.

CVE-2017-2895 [HIGH] CWE-125 CVE-2017-2895: An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality o An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause an arbitrary out-of-bounds memory read potentially resulting in information disclosure and denial of service. An attacker needs to send a specially crafted MQTT packet over the ne

CVE-2026-42334 [HIGH] CWE-74 Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection ### Impact This vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the `$nor` operator. When sanitizeFilter is enabled, Mongoose wraps query operators in `$eq` to neutralize them. However, prior to the fix, `$nor` was not included in the set of logical operat

CVE-2024-42386 [HIGH] CWE-823 CVE-2024-42386: Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an atta Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentation fault on the application.

CVE-2026-73258 [MEDIUM] CWE-697 CVE-2026-73258: Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mg_http_next_multipart() in src/http.c. The loops comparing s[b] and s[b + 1], and s[h2] and s[h2 + 1], use an incorrect AND condition and stop when either character resembles part of