CVE-2024-42386
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Out-of-range pointer offset vulnerability in Cesanta Mongoose Web Server v7.14. An attacker can send an unexpected TLS packet and cause a segmentation fault.
Risk Assessment
Potential denial of service (crash) of the web server.
Recommendation
Update Mongoose Web Server to a version newer than 7.14.
Other vulnerabilities in Cesanta Mongoose Web Server
See all- CVE-2024-42392Medium
Improper delimiter neutralization vulnerability in Cesanta Mongoose Web Server v7.14 allows triggering an infinite loop bug if the input string contains unexpected characters.
- CVE-2024-42391Medium
Out-of-range pointer offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.
- CVE-2024-42385Medium
Improper delimiter neutralization vulnerability in Cesanta Mongoose Web Server v7.14 allows triggering an out-of-bound memory write if the PEM certificate contains unexpected characters.
- CVE-2024-42384High
Integer overflow vulnerability in Cesanta Mongoose Web Server v7.14. An attacker can send an unexpected TLS packet and cause a segmentation fault.
Original NVD description (English source)
Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentation fault on the application.