CVE-2026-2966

Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values

Medium6.3EPSS 0.44%

Published: 23 Feb 2026
Updated: 23 Feb 2026
Reserved: 22 Feb 2026
Assigned by: VulDB

Description

A weakness has been identified in Cesanta Mongoose up to 7.20. The impacted element is the function mg_sendnsreq of the file /src/dns.c of the component DNS Transaction ID Handler. Executing a manipulation of the argument random can lead to insufficiently random values. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is regarded as difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

CVSS scores of CVE-2026-2966, by who scored it
Scored by	CVSS	Score	Vector
VulDBCNA (assigner)	4.0	Medium6.3	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
VulDBCNA (assigner)	3.1	Low3.7	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
VulDBCNA (assigner)	3.0	Low3.7	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
VulDBCNA (assigner)	2.0	Low2.6	AV:N/AC:H/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR
NVDNVD · Analyzed	4.0	Low2.9	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.44% · top 62% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.3.

Weakness

Affected products

Cesanta · Mongoose
- affected 7.0
- affected 7.1
- affected 7.2
- affected 7.3
- affected 7.4
- affected 7.5
- affected 7.6
- affected 7.7
- affected 7.8
- affected 7.9
- affected 7.10
- affected 7.11
- affected 7.12
- affected 7.13
- affected 7.14
- affected 7.15
- affected 7.16
- affected 7.17
- affected 7.18
- affected 7.19
- affected 7.20

References (5)

VDB-347333 | Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values (opens in a new tab)vdb-entrytechnical-description
VDB-347333 | CTI Indicators (IOB, IOC, TTP, IOA) (opens in a new tab)signaturepermissions-required
Submit #755304 | Cesanta Mongoose Embedded Web Server 7.20 Insufficiently Random Values (opens in a new tab)third-party-advisory
https://github.com/dwBruijn/CVEs/blob/main/Mongoose/mg_sendnsreq.md (opens in a new tab)related
https://github.com/dwBruijn/CVEs/blob/main/Mongoose/mg_sendnsreq.md#poc (opens in a new tab)exploit

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-2966](https://trackcve.app/badge/CVE-2026-2966.svg)](https://trackcve.app/cve/CVE-2026-2966)

Record last updated 23 Feb 2026, 13:36 UTC.