Mongoose Networking CVE-2026-52052

MEDIUM

2026-08-13 vendor:ubuntu

Severity by source

vuln.today AI

4.8 MEDIUM

Network vector since TLS peer can be remote; AC:H because attacker must control or impersonate a TLS endpoint; OOB read yields partial confidentiality and availability (crash) but no integrity impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Estimated by vuln.today — no official severity rating has been published for this CVE yet.

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 20:18 vuln.today

DescriptionCVE.org

[mg_tls_parse_cert_der pubkey BIT STRING length underflow -- OOB read]

AnalysisAI

Out-of-bounds read in Mongoose's TLS certificate parsing function mg_tls_parse_cert_der allows an attacker to trigger memory disclosure or crash via a crafted DER-encoded certificate containing a malformed pubkey BIT STRING with an underflowing length field. Affected deployments include any embedded or IoT application using Mongoose's built-in TLS stack that processes externally-supplied certificates. No public exploit or KEV listing is confirmed at time of analysis.

Technical ContextAI

Mongoose (mg) is a widely-used C networking library targeting embedded systems and IoT devices. Its built-in TLS implementation parses X.509 certificates in DER (Distinguished Encoding Rules) format. The vulnerable function mg_tls_parse_cert_der extracts the SubjectPublicKeyInfo BIT STRING from the certificate. An integer underflow in the length field calculation causes a negative or zero-length read window, leading to an out-of-bounds read beyond the intended buffer. CWE data is not provided in the source intelligence, but the vulnerability class is consistent with CWE-191 (Integer Underflow) leading to CWE-125 (Out-of-Bounds Read). No CPE strings were supplied; affected versions must be confirmed via the upstream Mongoose repository and Ubuntu advisory.

Affected ProductsAI

The affected product is the Mongoose embedded networking library, specifically its TLS certificate parsing subsystem (mg_tls_parse_cert_der). The vulnerability was reported by Ubuntu, suggesting the Ubuntu-packaged Mongoose is affected. Exact affected version ranges are not specified in the available intelligence; consumers should consult the Ubuntu security advisory and the upstream Mongoose GitHub repository for confirmed version bounds. No CPE strings were provided in the source data.

RemediationAI

Upgrade to a patched version of Mongoose as soon as one is identified via the Ubuntu security tracker or the upstream Mongoose release page. No exact patch version is confirmed in the available intelligence - the patch status is 'patch available per vendor advisory' based on Ubuntu's report, but a specific fixed release has not been independently verified. As a compensating control, restrict the network paths over which attacker-influenced TLS certificates can reach the vulnerable parser: for TLS clients, enforce certificate pinning or restrict accepted CA chains; for mutual-TLS servers, disable client certificate authentication if not operationally required. Disabling the Mongoose built-in TLS stack in favor of an external TLS library (e.g., mbedTLS, wolfSSL) eliminates the vulnerable code path but requires significant integration effort. Monitor the Ubuntu USN tracker and the Mongoose GitHub repository for patch releases.