Severity by source
Network-reachable DER parser, no authentication required pre-handshake; OOB read yields info-leak and crash but no integrity impact.
Estimated by vuln.today — no official severity rating has been published for this CVE yet.
Lifecycle Timeline
1DescriptionCVE.org
[mg_der_to_tlv long-form DER length OOB read]
AnalysisAI
Out-of-bounds read in the mg_der_to_tlv function of what appears to be the Mongoose embedded networking library allows processing of crafted long-form DER-encoded data to trigger memory disclosure or a crash. The vulnerability occurs in DER-to-TLV conversion when parsing oversized or malformed length fields in DER-encoded structures such as X.509 certificates during TLS handshakes. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Technical ContextAI
DER (Distinguished Encoding Rules) is a binary encoding standard used for X.509 certificates, ASN.1 structures, and TLS-related data. DER supports both short-form length encoding (single byte, values 0-127) and long-form encoding (multi-byte, for lengths above 127). The function mg_der_to_tlv - named with the 'mg_' prefix characteristic of the Cesanta Mongoose embedded C networking library - converts DER-encoded data into TLV (Tag-Length-Value) format. An out-of-bounds read (CWE-125 class, inferred) occurs when the code fails to properly validate the long-form length field before reading beyond the buffer boundary. This class of flaw typically arises when the declared length value exceeds the actual remaining buffer size and the code does not bounds-check prior to memory access. Affected CPE data was not provided; the product association with Mongoose is inferred from the function naming convention.
Affected ProductsAI
The affected product is inferred to be the Mongoose embedded networking library (likely by Cesanta), based on the 'mg_' function prefix in the vulnerability identifier mg_der_to_tlv. Specific affected versions are not confirmed in the provided data. The Ubuntu vendor reported this issue, suggesting it affects a package present in Ubuntu's repositories. No CPE strings were provided. Consumers of Mongoose or libraries embedding Mongoose for TLS/certificate handling should consult the upstream Mongoose repository and Ubuntu security advisories for version-specific guidance.
RemediationAI
No vendor-released patch or exact fix version was identified in the provided data. As Mongoose is an open-source library, monitor the Cesanta Mongoose GitHub repository for commits or releases addressing mg_der_to_tlv long-form DER length handling. Ubuntu users should track USN advisories for any affected package updates. As a compensating control, restrict network exposure of services using Mongoose for TLS termination so that untrusted clients cannot initiate connections triggering DER parsing - note this trade-off reduces availability. Additionally, consider enabling crash-restart supervisors (systemd, Docker restart policies) to limit DoS impact duration. Disabling client certificate authentication where not required removes one DER parsing trigger with minimal functionality loss in many deployments. No advisory URL was present in the provided references.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today