Severity by source
Network-reachable DER parsing, no credentials needed pre-TLS, no confidentiality or integrity impact, only availability via stack crash.
Lifecycle Timeline
1DescriptionCVE.org
[mg_der_find_oid unbounded recursion on constructed DER tags]
AnalysisAI
Unbounded recursion in Mongoose's DER parsing function mg_der_find_oid allows a remote attacker to trigger a stack overflow by sending crafted ASN.1/DER data containing deeply nested constructed tags, likely resulting in a denial of service through process crash. Affected deployments include any application using Mongoose's TLS or certificate-parsing code paths that process externally-supplied DER-encoded input. No public exploit has been identified at time of analysis, and this vulnerability was reported via the Ubuntu vendor channel.
Technical ContextAI
Mongoose (by Cesanta) is a lightweight C networking library widely used in embedded systems, IoT devices, and resource-constrained environments. The affected function mg_der_find_oid implements OID (Object Identifier) lookup within DER (Distinguished Encoding Rules) - the binary encoding format underpinning ASN.1 structures used in X.509 certificates and TLS handshakes. The vulnerability arises because the function recurses into constructed DER tag types (e.g., SEQUENCE, SET) without enforcing a recursion depth limit. A maliciously crafted DER structure with arbitrarily deep nesting can exhaust the call stack. The root cause class is uncontrolled recursion (analogous to CWE-674), which in C programs typically results in a stack overflow and process termination. No CWE was formally assigned in the provided data.
Affected ProductsAI
The affected product is the Mongoose C networking library, specifically the DER/ASN.1 parsing subsystem containing the mg_der_find_oid function. Exact affected versions are not specified in the available data - the vulnerability was reported via the Ubuntu vendor channel, suggesting Ubuntu-packaged versions of Mongoose or software embedding it may be affected. No CPE string or precise version range was provided. Consumers should consult the Mongoose upstream repository (Cesanta) and Ubuntu security advisories for precise version scope.
RemediationAI
Apply the upstream patch from the Cesanta Mongoose repository addressing the unbounded recursion in mg_der_find_oid; no specific patched version number is confirmed from the available data, so monitor the upstream changelog and Ubuntu security tracker for a fixed release. Until a patch is available, compensating controls include: restricting network access to services built on Mongoose so that only trusted peers can initiate TLS handshakes or submit DER-encoded data; enforcing DER input size limits at the application or network perimeter level to reduce nesting feasibility; and deploying process supervisors or watchdog timers to automatically restart crashed instances, reducing availability impact. Each of these workarounds carries trade-offs - perimeter filtering may break legitimate certificate chains, and watchdog restarts do not prevent repeated exploitation.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today