CVE-2024-42392
MediumCVSS 4.0Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Improper delimiter neutralization vulnerability in Cesanta Mongoose Web Server v7.14 allows triggering an infinite loop bug if the input string contains unexpected characters.
Risk Assessment
This can lead to application hang or resource exhaustion, resulting in service unavailability.
Recommendation
Update Cesanta Mongoose to a version that includes a fix eliminating the infinite loop issue.
Other vulnerabilities in Cesanta Mongoose Web Server
See all- CVE-2024-42391Medium
Out-of-range pointer offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.
- CVE-2024-42386High
Out-of-range pointer offset vulnerability in Cesanta Mongoose Web Server v7.14. An attacker can send an unexpected TLS packet and cause a segmentation fault.
- CVE-2024-42385Medium
Improper delimiter neutralization vulnerability in Cesanta Mongoose Web Server v7.14 allows triggering an out-of-bound memory write if the PEM certificate contains unexpected characters.
- CVE-2024-42384High
Integer overflow vulnerability in Cesanta Mongoose Web Server v7.14. An attacker can send an unexpected TLS packet and cause a segmentation fault.
Original NVD description (English source)
Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an infinite loop bug if the input string contains unexpected characters.