CVE-2026-11404
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
Cesanta Mongoose before version 7.22 has an out-of-bounds read vulnerability in the mg_tls_server_recv_hello() function. An attacker can send a crafted ClientHello with an oversized session ID length, causing a read past the buffer and crashing HTTPS, MQTTS, or WSS services.
Risk Assessment
A remote, unauthenticated attacker can crash the server, disrupting critical services such as secure communication via HTTPS, MQTT, or WebSocket, impacting business continuity.
Recommendation
Immediately update Cesanta Mongoose to version 7.22 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Cesanta Mongoose
See all- CVE-2017-2909High
An infinite loop programming error exists in the DNS server functionality of Cesanta Mongoose 6.8 library. A specially crafted DNS request can cause an infinite loop resulting in high CPU usage and Denial Of Service.
- CVE-2017-2895High
CVE-2017-2895 describes an exploitable arbitrary memory read vulnerability in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can lead to information disclosure and denial of service.
- CVE-2017-2893High
A NULL pointer dereference vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8, which can lead to server crashes. Sending a specially crafted MQTT SUBSCRIBE packet by an attacker can trigger this vulnerability.
- CVE-2017-2922Critical
CVE-2017-2922 describes a memory corruption vulnerability in the Websocket protocol implementation of Cesanta Mongoose 6.8. A specially crafted websocket packet can lead to a buffer being allocated with stale pointers, resulting in a use-after-free vulnerability that can be exploited for remote code execution.
- CVE-2017-2921Critical
CVE-2017-2921 describes a vulnerability in the Websocket protocol implementation of Cesanta Mongoose 6.8 that can lead to heap buffer overflow. A specially crafted websocket packet can cause an integer overflow, resulting in denial of service and potential remote code execution.
- CVE-2017-2894Critical
CVE-2017-2894 describes a stack buffer overflow vulnerability in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause a buffer overflow, leading to remote code execution.
- CVE-2017-2892Critical
An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT packet can cause an arbitrary out-of-bounds memory read and write potentially resulting in information disclosure, denial of service and remote code execution.
- CVE-2017-2891Critical
CVE-2017-2891 describes a use-after-free vulnerability in the HTTP server implementation of Cesanta Mongoose 6.8. An ordinary HTTP POST request with a CGI target can cause a reuse of previously freed pointer, potentially leading to remote code execution.
Original NVD description (English source)
Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function mg_tls_server_recv_hello(), which uses an attacker-controlled session_id_len byte from a TLS ClientHello as a buffer index without validating it against the length of received data. A remote, unauthenticated attacker can send a single crafted ClientHello with an oversized session id length to read past the receive buffer, crashing any HTTPS, MQTTS, or WSS service built on MG_TLS_BUILTIN.