CVE-2024-42384
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
Integer overflow vulnerability in Cesanta Mongoose Web Server v7.14. An attacker can send an unexpected TLS packet and cause a segmentation fault.
Risk Assessment
Potential denial of service (crash) of the web server.
Recommendation
Update Mongoose Web Server to a version newer than 7.14.
Other vulnerabilities in Cesanta Mongoose Web Server
See all- CVE-2024-42392Medium
Improper delimiter neutralization vulnerability in Cesanta Mongoose Web Server v7.14 allows triggering an infinite loop bug if the input string contains unexpected characters.
- CVE-2024-42391Medium
Out-of-range pointer offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.
- CVE-2024-42386High
Out-of-range pointer offset vulnerability in Cesanta Mongoose Web Server v7.14. An attacker can send an unexpected TLS packet and cause a segmentation fault.
- CVE-2024-42385Medium
Improper delimiter neutralization vulnerability in Cesanta Mongoose Web Server v7.14 allows triggering an out-of-bound memory write if the PEM certificate contains unexpected characters.
Original NVD description (English source)
Integer Overflow or Wraparound vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentation fault on the application.