Cesanta vulnerabilities

CVEs per yearBy the year they were published

1. 20178
2. 20231
3. 202410
4. 20252
5. 202623
6. 20261

Newest CVEs

• CVE-2026-63626

  Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6)

  cesanta · mongoose

  High8.8
• CVE-2026-73261

  Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connection

  cesanta · mongoose

  High7.5
• CVE-2026-73260

  Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser

  cesanta · mongoose

  High7.5
• CVE-2026-73252

  Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAX

  cesanta · mongoose

  High7.5
• CVE-2026-101003

  Cesanta Mongoose MQTT Broker main.c fn stack-based overflow

  Cesanta · Mongoose

  Medium6.9
• CVE-2026-86716

  Cesanta mJS mjs_tok.c skip_spaces_and_comments heap-based overflow

  Cesanta · mJS

  Medium6.9
• CVE-2026-73253

  Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching

  cesanta · mongoose

  Critical9.1
• CVE-2026-73255

  Mongoose: Path traversal in SSI #include directives enables arbitrary file read

  cesanta · mongoose

  Medium6.5
• CVE-2026-73259

  Mongoose: Reflected XSS via decoded URI in directory listing render

  cesanta · mongoose

  Medium5.4
• CVE-2026-73256

  Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE

  cesanta · mongoose

  Critical9.1