Severity by source
Network-reachable DER parser with no auth required; impact limited to OOB read causing memory disclosure or crash, no integrity effect.
Estimated by vuln.today — no official severity rating has been published for this CVE yet.
Lifecycle Timeline
1DescriptionCVE.org
[mg_der_to_tlv long-form DER length OOB read]
AnalysisAI
Out-of-bounds read in the Mongoose networking library's mg_der_to_tlv function allows processing of crafted DER-encoded data with malformed long-form length fields to read memory beyond the intended buffer boundary. Affected deployments include any application embedding Mongoose that processes TLS certificates or other DER-encoded structures from untrusted sources. An attacker who can supply crafted DER input may cause information disclosure from adjacent memory or trigger a crash, depending on memory layout.
Technical ContextAI
DER (Distinguished Encoding Rules) encodes data as Tag-Length-Value (TLV) triplets. When a length value exceeds 127 bytes, DER uses a 'long-form' encoding where the first byte signals how many subsequent bytes carry the actual length value. The function mg_der_to_tlv in the Mongoose embedded networking library (mg_ prefix is Mongoose's naming convention) parses these structures. The vulnerability arises when the parser does not validate that the stated number of length-encoding bytes are actually present in the buffer before reading them, producing an out-of-bounds read. The root cause class is a missing bounds check on variable-length field parsing - analogous to CWE-125 (Out-of-bounds Read), though NVD has not assigned a CWE for this entry. Mongoose is a widely used C networking library for embedded systems and IoT firmware, providing TCP/UDP/HTTP/TLS in a single-file implementation.
Affected ProductsAI
The affected product is the Mongoose embedded networking library, specifically the mg_der_to_tlv function responsible for parsing DER-encoded TLV structures. Exact affected version ranges are not confirmed in the available data - NVD CPE strings are absent and the Ubuntu advisory has not yet published a version-bounded range. Deployments of Mongoose in firmware, IoT devices, and embedded C applications that process untrusted DER input (e.g., TLS certificate chains, PKCS structures) should be considered potentially affected until vendor clarification is available. The Ubuntu tracker is the primary reference source at time of analysis.
RemediationAI
No confirmed patch version is independently verifiable from the available data. Upstream fix availability (PR or commit) should be confirmed against the Mongoose GitHub repository by searching for commits referencing mg_der_to_tlv or long-form DER length handling. Operators should upgrade to the newest Mongoose release once a fix is tagged. As an immediate compensating control, restrict which network interfaces and sources are permitted to initiate TLS handshakes or supply DER-encoded data to Mongoose-based services - this reduces the attacker-reachable surface without disabling TLS entirely. If the service does not require mutual TLS or client-certificate validation, disabling client certificate acceptance removes the primary externally-controllable DER parsing path. Monitor the Ubuntu Security Notices (USN) feed and the Mongoose upstream repository for a patched release advisory.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today