Cesanta

By the Year

In 2026 there have been 18 vulnerabilities in Cesanta with an average score of 6.3 out of ten. Last year, in 2025 Cesanta had 1 security vulnerability published. That is, 17 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 2.03.

Recent Cesanta Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-73253	Aug 20, 2026	Mongoose TLS Hostname Verification Bypass Before 7.22 Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mg_tls_verify_cert_san() and mg_tls_verify_cert_cn() functions in src/tls_builtin.c call mg_match(), whose wildcard can cross DNS label boundaries, so a pattern such as *.example.com can match foo.bar.example.com. The resulting hostname verification bypass permits interception and modification of TLS traffic. This issue is fixed in version 7.22.	Mongoose
CVE-2026-73255	Aug 20, 2026	Mongoose <7.22 Directory Traversal via SSI #include Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an #include file or #include virtual directive. The mg_ssi() function in src/ssi.c concatenates the directive argument into a filesystem path without calling mg_path_is_sane(), allowing an MG_ENABLE_SSI deployment with ssi_pattern configured to disclose files readable by the Mongoose process. This issue is fixed in version 7.22.	Mongoose
CVE-2026-73259	Aug 20, 2026	Mongoose <7.22 Reflected XSS via mg_http_serve_dir Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MG_ENABLE_DIRLIST and persuade a user to visit it. The mg_http_serve_dir() and listdir() path in src/http.c places the decoded request URI into the title and h1 elements without HTML entity encoding. The resulting reflected cross-site scripting executes in the Mongoose origin and can expose session data or perform actions as the victim. This issue is fixed in version 7.22.	Mongoose
CVE-2026-73256	Aug 20, 2026	Mongoose <7.22 HTTP/1.0 Reverse-Proxy Chunked Request Smuggling Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http_cb() function in src/http.c tests hm.proto.len with an impossible greater-than-eight condition even though mg_http_parse() requires an eight-byte protocol string, so is_http_1_0 is never set. Mongoose consequently processes chunked encoding that an HTTP/1.0 proxy can ignore, enabling request smuggling and unauthorized access or state changes. This issue is fixed in version 7.22.	Mongoose
CVE-2026-73254	Aug 20, 2026	Stored XSS in Mongoose <7.22 via printdirentry Directory Listing Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MG_ENABLE_DIRLIST. The printdirentry() path called by listdir() in src/http.c URL-encodes the href but inserts the raw filesystem filename into the HTML link text. The browser executes the injected markup in the Mongoose origin, which can expose session data or permit actions as the victim. This issue is fixed in version 7.22.	Mongoose
CVE-2026-73258	Aug 20, 2026	Mongoose 7.21 CRLF Injection via mg_http_next_multipart() Headers Truncation Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mg_http_next_multipart() in src/http.c. The loops comparing s[b] and s[b + 1], and s[h2] and s[h2 + 1], use an incorrect AND condition and stop when either character resembles part of a CRLF terminator. This truncates headers, filenames, or boundaries and can cause an application to accept dangerous content after seeing a misleading Content-Type value. This issue is fixed in version 7.22.	Mongoose
CVE-2026-73251	Aug 20, 2026	Mongoose <7.23 TLS server impersonation via CA bundle bug Mongoose is an embedded web server and network library. Prior to 7.23, a network attacker can impersonate a TLS server to a Mongoose client configured with a multi-certificate CA bundle. In src/tls_builtin.c, the mg_tls_init() function stores the bundle in tls->ca_bundle_der while tls->ca_der.len remains zero, and mg_tls_recv_cert() uses tls_bundle_find() to accept a Common Name match without calling mg_tls_verify_cert_signature(). A forged self-signed certificate can therefore satisfy hostname and CertificateVerify checks and enable interception, credential disclosure, traffic modification, and malicious responses. This issue is fixed in version 7.23.	Mongoose
CVE-2026-73257	Aug 20, 2026	Mongoose <7.22: HTTP CL.TE Desync Allows Remote Context Hijack Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_http_parse() and http_cb() paths in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy can use a different request boundary. This CL.TE desynchronization can inject requests that access or modify resources in another user context. This issue is fixed in version 7.22.	Mongoose
CVE-2026-11404	Jul 09, 2026	Cesanta Mongoose7.21 OOB Read in mg_tls via ClientHello Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function mg_tls_server_recv_hello(), which uses an attacker-controlled session_id_len byte from a TLS ClientHello as a buffer index without validating it against the length of received data. A remote, unauthenticated attacker can send a single crafted ClientHello with an oversized session id length to read past the receive buffer, crashing any HTTPS, MQTTS, or WSS service built on MG_TLS_BUILTIN.	Mongoose
CVE-2026-6986	Apr 25, 2026	Cesanta Mongoose <7.21: GCM Auth Tag Verification Failure A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This issue affects the function mg_aes_gcm_decrypt of the file /src/tls_aes128.c of the component GCM Authentication Tag Handler. Such manipulation leads to improper verification of cryptographic signature. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 7.21 is capable of addressing this issue. It is advisable to upgrade the affected component. VulDB has contacted the vendor early and they confirmed quickly, that this issue got fixed already.	Mongoose
CVE-2026-6985	Apr 25, 2026	Cesanta Mongoose 7.20 TCP Option Handler Infinite Loop A weakness has been identified in Cesanta Mongoose up to 7.20. This vulnerability affects the function handle_opt of the file /src/net_builtin.c of the component TCP Option Handler. This manipulation of the argument optlen causes infinite loop. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 7.21 is able to resolve this issue. Upgrading the affected component is advised. VulDB has contacted the vendor early and they confirmed quickly, that this issue got fixed already.	Mongoose
CVE-2026-5246	Apr 02, 2026	Cesanta Mongoose <=7.20: P-384 PUB KEY handler RCE, auth bypass A vulnerability was determined in Cesanta Mongoose up to 7.20. Affected is the function mg_tls_verify_cert_signature of the file mongoose.c of the component P-384 Public Key Handler. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. Attacks of this nature are highly complex. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 7.21 is able to address this issue. This patch is called 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.	Mongoose
CVE-2026-5245	Apr 02, 2026	Cesanta Mongoose 7.20 mDNS Record Buffer Overflow (stack-based) A vulnerability was found in Cesanta Mongoose up to 7.20. This impacts the function handle_mdns_record of the file mongoose.c of the component mDNS Record Handler. Performing a manipulation of the argument buf results in stack-based buffer overflow. Remote exploitation of the attack is possible. A high degree of complexity is needed for the attack. The exploitability is said to be difficult. The exploit has been made public and could be used. Upgrading to version 7.21 will fix this issue. The patch is named 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.	Mongoose
CVE-2026-5244	Apr 02, 2026	Cesanta Mongoose TLS 1.3 Handler Heap Overflow before 7.20 (Fixed in 7.21) A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mongoose.c of the component TLS 1.3 Handler. Such manipulation of the argument pubkey leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.21 mitigates this issue. The name of the patch is 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.	Mongoose
CVE-2018-25193	Mar 06, 2026	Mongoose Web Server 6.9 DoS via Multiple Socket Connections Mongoose Web Server 6.9 contains a denial of service vulnerability that allows remote attackers to crash the service by establishing multiple socket connections. Attackers can repeatedly create connections to the default port and send malformed data to exhaust server resources and cause service unavailability.	Mongoose
CVE-2026-2968	Feb 23, 2026	Cesanta Mongoose <=7.20 Poly1305 Tag Handler Signature Verification Bypass A vulnerability was detected in Cesanta Mongoose up to 7.20. This impacts the function mg_chacha20_poly1305_decrypt of the file /src/tls_chacha20.c of the component Poly1305 Authentication Tag Handler. The manipulation results in improper verification of cryptographic signature. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is said to be difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Mongoose
CVE-2026-2967	Feb 23, 2026	Cesanta Mongoose <=7.20 TCPSN Handler Getpeer Remote Sequence Num Bypass A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This affects the function getpeer of the file /src/net_builtin.c of the component TCP Sequence Number Handler. The manipulation leads to improper verification of source of a communication channel. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.	Mongoose
CVE-2026-2966	Feb 23, 2026	Cesanta Mongoose7.20 DNS Txn ID Handler Randomness Weakness A weakness has been identified in Cesanta Mongoose up to 7.20. The impacted element is the function mg_sendnsreq of the file /src/dns.c of the component DNS Transaction ID Handler. Executing a manipulation of the argument random can lead to insufficiently random values. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is regarded as difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.	Mongoose
CVE-2025-65502	Nov 24, 2025	Cesanta Mongoose <7.2 NOPTRD in add_ca_certs() TLS DoS Null pointer dereference in add_ca_certs() in Cesanta Mongoose before 7.2 allows remote attackers to cause a denial of service via TLS initialization where SSL_CTX_get_cert_store() returns NULL.	Mongoose
CVE-2024-42383	Nov 18, 2024	Cesanta Mongoose Web Server: Out-of-range Pointer Offset Vulnerability Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows to write a NULL byte value beyond the memory space dedicated for the hostname field.	Mongoose
CVE-2024-42384	Nov 18, 2024	Cesanta Mongoose Web Server v7.14 TLS Packet Handling Integer Overflow Vulnerability Integer Overflow or Wraparound vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentation fault on the application.	Mongoose
CVE-2024-42385	Nov 18, 2024	Cesanta Mongoose Web Server: Improper Neutralization of Delimiters Leading to Out-of-Bounds Memory W Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an out-of-bound memory write if the PEM certificate contains unexpected characters.	Mongoose
CVE-2024-42386	Nov 18, 2024	Cesanta Mongoose Web Server: Use of Out-of-range Pointer Offset in TLS Handling Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentation fault on the application.	Mongoose
CVE-2024-42387	Nov 18, 2024	Cesanta Mongoose Web Server: Use of Out-of-range Pointer Offset Vulnerability Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.	Mongoose
CVE-2024-42388	Nov 18, 2024	Cesanta Mongoose Web Server: Out-of-range Pointer Offset Vulnerability in TLS Handling Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.	Mongoose
CVE-2024-42389	Nov 18, 2024	Cesanta Mongoose Web Server: Use of Out-of-range Pointer Offset Vulnerability Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.	Mongoose
CVE-2024-42390	Nov 18, 2024	Cesanta Mongoose Web Server: Out-of-range Pointer Offset Vulnerability in TLS Handling Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.	Mongoose
CVE-2024-42391	Nov 18, 2024	Cesanta Mongoose Web Server: Out-of-range Pointer Offset Vulnerability in TLS Handling Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.	Mongoose
CVE-2024-42392	Nov 18, 2024	Cesanta Mongoose Web Server: Improper Neutralization of Delimiters Leading to Infinite Loop Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an infinite loop bug if the input string contains unexpected characters.	Mongoose
CVE-2024-35492	May 29, 2024	Cesanta Mongoose MQTT Null Pointer Deref in scpy (DoS) Cesanta Mongoose commit b316989 was discovered to contain a NULL pointer dereference via the scpy function at src/fmt.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MQTT packet.	Mongoose
CVE-2024-35384	May 21, 2024	Cesanta mjs 2.20.0 Remote DoS via mjs_array_length in mjs.c An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_array_length function in the mjs.c file.	Mjs
CVE-2024-35385	May 21, 2024	Cesanta mjs 2.20.0 DOS via mjs_mk_ffi_sig in mjs.c An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_mk_ffi_sig function in the mjs.c file.	Mjs
CVE-2024-35386	May 21, 2024	Cesanta mjs 2.20.0 DoS via mjs_do_gc An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_do_gc function in the mjs.c file.	Mjs
CVE-2023-49549	Jan 02, 2024	Cesanta mjs 2.20.0 DoS via mjs_getretvalpos in msj.c An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_getretvalpos function in the msj.c file.	Mjs
CVE-2023-49552	Jan 02, 2024	OOB Write in Cesanta mjs 2.20.0 via mjs_op_json_stringify An Out of Bounds Write in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_stringify function in the msj.c file.	Mjs
CVE-2023-49553	Jan 02, 2024	Cesanta mjs 2.20.0 DoS via mjs_destroy in msj.c An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_destroy function in the msj.c file.	Mjs
CVE-2023-49550	Jan 02, 2024	Remote DoS in Cesanta mjs 2.20.0 via mjs+0x4ec508 component An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs+0x4ec508 component.	Mjs
CVE-2023-49551	Jan 02, 2024	Cesanta mjs 2.20.0 Remote DoS via mjs_op_json_parse in msj.c An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_parse function in the msj.c file.	Mjs
CVE-2023-50044	Dec 20, 2023	Cesanta MJS 2.20.0 OOB Read via getprop_builtin_foreign Cesanta MJS 2.20.0 has a getprop_builtin_foreign out-of-bounds read if a Built-in API name occurs in a substring of an input string.	Mjs
CVE-2023-43338	Sep 23, 2023	Cesanta mjs v2.20.0 - Function Pointer Hijack via mjs_get_ptr() Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the function mjs_get_ptr(). This vulnerability allows attackers to execute arbitrary code via a crafted input.	Mjs
CVE-2020-25887	Aug 22, 2023	BUFOVF in Mongoose 6.18 mg_resolve_from_hosts_file Buffer overflow in mg_resolve_from_hosts_file in Mongoose 6.18, when reading from a crafted hosts file.	Mongoose
CVE-2023-2905	Aug 09, 2023	Cesanta Mongoose 7.10 Heap Overflow via MQTT Publish Header Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web server, version 7.10 is susceptible to a heap-based buffer overflow vulnerability in the default configuration. Version 7.9 and prior does not appear to be vulnerable. This issue is resolved in version 7.11.	Mongoose
CVE-2023-34188	Jun 23, 2023	Mongoose <7.10 HTTP Server Nega Content-Length Infinite Loop DDoS The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests.	Mongoose
CVE-2023-30088	May 09, 2023	Cesanta MJS 1.26 local DoS via mjs_execute An issue found in Cesanta MJS v.1.26 allows a local attacker to cause a denial of service via the mjs_execute function in mjs.c.	Mjs
CVE-2023-30087	May 09, 2023	Cesanta MJS v1.26 Buffer Overflow in mjs_mk_string causes DoS Buffer Overflow vulnerability found in Cesanta MJS v.1.26 allows a local attacker to cause a denial of service via the mjs_mk_string function in mjs.c.	Mjs
CVE-2023-29570	Apr 24, 2023	Cesanta MJS 2.20.0 SEGV via mjs_ffi_cb_free leads to DoS Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_ffi_cb_free at src/mjs_ffi.c. This vulnerability can lead to a Denial of Service (DoS).	Mjs
CVE-2023-29569	Apr 14, 2023	Cesanta MJS <2.20.0 SEGV via ffi_cb_impl_wpwwwww DoS Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via ffi_cb_impl_wpwwwww at src/mjs_ffi.c. This vulnerability can lead to a Denial of Service (DoS).	Mjs
CVE-2023-29571	Apr 12, 2023	Cesanta MJS 2.20.0 SEGV DoS via gc_sweep Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via gc_sweep at src/mjs_gc.c. This vulnerability can lead to a Denial of Service (DoS).	Mjs
CVE-2021-36535	Feb 03, 2023	CVE-2021-36535: Remote Buffer Overflow in Cesanta mJS 1.26 via crafted .js Buffer Overflow vulnerability in Cesanta mJS 1.26 allows remote attackers to cause a denial of service via crafted .js file to mjs_set_errorf.	Mjs
CVE-2021-33437	Jul 26, 2022	Memory leak in frozen_cb() of mJS (Restricted JS Engine) An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There are memory leaks in frozen_cb() in mjs.c.	Mjs