Cesanta Mongoose any version

An invalid read of 8 bytes due to a use-after-free vulnerability during a "return" in the mg_http_get_proto_data function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution.

An invalid write of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution.

An invalid read of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution.

An invalid read of 8 bytes due to a use-after-free vulnerability during a "NULL test" in the mg_http_get_proto_data function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution.

An issue was discovered in Mongoose before 6.15. The parse_mqtt() function in mg_mqtt.c has a critical heap-based buffer overflow.

Arbitrary File Write

Cesanta Mongoose TLS 1.3 mongoose.c mg_tls_recv_cert heap-based overflow

Use of Out-of-range Pointer Offset in Mongoose Web Server library

The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable to remote OOB write attack via connection request after exhausting memory pool.

Use of Out-of-range Pointer Offset in Mongoose Web Server library

Cesanta Mongoose mDNS Record mongoose.c handle_mdns_record stack-based overflow

Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization

The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests.

Cesanta Mongoose TCP Option net_builtin.c handle_opt infinite loop

Integer Overflow or Wraparound in Mongoose Web Server library

An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17. By sending a specially crafted WebSocket request, an attacker can cause the application to crash. If downstream vendors integrate this component improperly, the issue may lead to a buffer overflow.

Improper Neutralization of Delimiters in Mongoose Web Server library

Improper Neutralization of Delimiters in Mongoose Web Server library

Use of Out-of-range Pointer Offset in Mongoose Web Server library

Use of Out-of-range Pointer Offset in Mongoose Web Server library

Use of Out-of-range Pointer Offset in Mongoose Web Server library

Use of Out-of-range Pointer Offset in Mongoose Web Server library

Use of Out-of-range Pointer Offset in Mongoose Web Server library

Null pointer dereference in add_ca_certs() in Cesanta Mongoose before 7.2 allows remote attackers to cause a denial of service via TLS initialization where SSL_CTX_get_cert_store() returns NULL.

Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of source

Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values

Cesanta Mongoose Poly1305 Authentication Tag tls_chacha20.c mg_chacha20_poly1305_decrypt signature verification

Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verification