CVE-2017-2909
HighSummary
An infinite loop programming error exists in the DNS server functionality of Cesanta Mongoose 6.8 library. A specially crafted DNS request can cause an infinite loop resulting in high CPU usage and Denial Of Service.
Risk Assessment
An attacker can send a packet over the network to trigger this vulnerability, potentially leading to significant service disruptions.
Recommendation
It is recommended to update the Cesanta Mongoose library to the latest version to mitigate this vulnerability and to monitor network traffic for potential attacks.
Other vulnerabilities in Cesanta Mongoose 6.8
See all- CVE-2017-2895High
CVE-2017-2895 describes an exploitable arbitrary memory read vulnerability in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can lead to information disclosure and denial of service.
- CVE-2017-2893High
A NULL pointer dereference vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8, which can lead to server crashes. Sending a specially crafted MQTT SUBSCRIBE packet by an attacker can trigger this vulnerability.
- CVE-2017-2922Critical
CVE-2017-2922 describes a memory corruption vulnerability in the Websocket protocol implementation of Cesanta Mongoose 6.8. A specially crafted websocket packet can lead to a buffer being allocated with stale pointers, resulting in a use-after-free vulnerability that can be exploited for remote code execution.
- CVE-2017-2921Critical
CVE-2017-2921 describes a vulnerability in the Websocket protocol implementation of Cesanta Mongoose 6.8 that can lead to heap buffer overflow. A specially crafted websocket packet can cause an integer overflow, resulting in denial of service and potential remote code execution.
- CVE-2017-2894Critical
CVE-2017-2894 describes a stack buffer overflow vulnerability in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause a buffer overflow, leading to remote code execution.
- CVE-2017-2892Critical
An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT packet can cause an arbitrary out-of-bounds memory read and write potentially resulting in information disclosure, denial of service and remote code execution.
- CVE-2017-2891Critical
CVE-2017-2891 describes a use-after-free vulnerability in the HTTP server implementation of Cesanta Mongoose 6.8. An ordinary HTTP POST request with a CGI target can cause a reuse of previously freed pointer, potentially leading to remote code execution.
- CVE-2026-11404High
Cesanta Mongoose before version 7.22 has an out-of-bounds read vulnerability in the mg_tls_server_recv_hello() function. An attacker can send a crafted ClientHello with an oversized session ID length, causing a read past the buffer and crashing HTTPS, MQTTS, or WSS services.
Original NVD description (English source)
An infinite loop programming error exists in the DNS server functionality of Cesanta Mongoose 6.8 library. A specially crafted DNS request can cause an infinite loop resulting in high CPU usage and Denial Of Service. An attacker can send a packet over the network to trigger this vulnerability.