Severity by source
Network-reachable pre-auth TLS parsing flaw; OOB read yields memory disclosure (C:L) and potential crash (A:L) with no write primitive.
Estimated by vuln.today — no official severity rating has been published for this CVE yet.
Lifecycle Timeline
1DescriptionCVE.org
[mg_tls_server_recv_hello session_id_len OOB read]
AnalysisAI
Out-of-bounds read in Mongoose's TLS server handshake function mg_tls_server_recv_hello exposes systems to memory disclosure or service disruption via a crafted TLS ClientHello packet. An unauthenticated remote attacker can trigger the vulnerability by supplying a malformed session_id_len field during TLS negotiation, before any authentication occurs. No public exploit has been identified at time of analysis, and the disclosure originates from Ubuntu vendor reporting, suggesting a downstream package audit or fuzzing discovery.
Technical ContextAI
Mongoose is a C-language embedded networking library by Cesanta, commonly used in IoT firmware, embedded Linux, and resource-constrained servers. Its built-in TLS stack implements both client and server handshake logic in C. The affected function mg_tls_server_recv_hello processes the TLS ClientHello message on the server side. The root cause is an out-of-bounds (OOB) read: when parsing the session_id_len field from an attacker-controlled ClientHello, the code reads a length value without sufficient bounds validation, then uses it to index into a buffer - allowing reads beyond the intended buffer boundary. This pattern maps to CWE-125 (Out-of-bounds Read). No CPE string was provided, so exact affected version ranges must be verified against Ubuntu security advisories and the upstream Cesanta Mongoose repository.
Affected ProductsAI
The affected product is the Mongoose embedded networking library (by Cesanta), specifically its TLS server implementation. The vulnerability was reported via the Ubuntu vendor channel, implying the affected package is distributed through Ubuntu repositories. Exact affected version ranges are not confirmed in the provided data - no CPE strings or version bounds were supplied. Administrators should consult the Ubuntu Security Notices (USN) and the upstream Mongoose GitHub repository (github.com/cesanta/mongoose) for the precise affected and fixed version ranges. All deployments using Mongoose's built-in TLS server functionality on Ubuntu-distributed packages should be treated as potentially affected until the vendor advisory specifies otherwise.
RemediationAI
The primary remediation is to upgrade the Mongoose library to the patched version identified in the Ubuntu security advisory associated with this CVE. Since no exact fix version was provided in the available data, administrators should query the Ubuntu USN tracker for CVE-2026-52051 to obtain the specific patched package version and apply it via standard package management (apt upgrade libmongoose or equivalent). As a compensating control where patching is not immediately possible, deployments can restrict TLS server exposure to trusted network segments using firewall rules to block untrusted clients from reaching Mongoose TLS listeners - this reduces the attack surface since the vulnerability is triggered during the unauthenticated handshake phase. If Mongoose is embedded in firmware, contact the device vendor for a firmware update. Note that disabling TLS entirely as a workaround would eliminate encryption protections and is not recommended except in isolated lab environments.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today