Severity by source
TLS handshake is network-exposed and pre-authentication (AV:N, PR:N); OOB read yields memory leakage (C:L) and potential crash (A:L) but no integrity impact.
Estimated by vuln.today — no official severity rating has been published for this CVE yet.
Lifecycle Timeline
1DescriptionCVE.org
[mg_tls_recv_cert certificate chain length unchecked -- OOB read]
AnalysisAI
Out-of-bounds read in Mongoose's TLS certificate reception function mg_tls_recv_cert allows a remote attacker to trigger a read beyond allocated buffer boundaries by presenting a certificate chain whose length is not validated. Affected deployments include any application embedding the Mongoose networking library that accepts TLS connections. No public exploit code has been identified at time of analysis, and the CVE has not been added to CISA KEV; however, the attack surface is pre-authentication and network-exposed during TLS handshake.
Technical ContextAI
Mongoose (prefix mg_) is an embedded networking library by Cesanta widely used in IoT firmware, embedded web servers, and lightweight C/C++ applications. The vulnerable function mg_tls_recv_cert is part of the TLS stack responsible for parsing inbound X.509 certificate chains during the TLS handshake. The root cause class aligns with CWE-125 (Out-of-bounds Read): the code reads elements from the certificate chain without first verifying that the declared or actual chain length falls within the bounds of the allocated buffer. An attacker who controls a TLS peer (e.g., a client connecting to a vulnerable server, or a server responding to a vulnerable client) can craft a certificate chain with an excessive or malformed length field to trigger the OOB read. No CWE is explicitly assigned in the input data; CWE-125 is inferred from the 'OOB read' description. No CPE strings were provided.
Affected ProductsAI
The affected product is the Mongoose embedded networking library, specifically its TLS implementation in the mg_tls_recv_cert function. The vulnerability was reported via Ubuntu's vendor channel, indicating it affects at least the version of Mongoose packaged in Ubuntu repositories. Exact affected version ranges are not confirmed in the available data - no CPE strings, no vendor advisory URL, and no fixed version are provided. Upstream Cesanta advisories and the Ubuntu Security Notices (USN) portal should be consulted to identify precise version boundaries once published.
RemediationAI
No vendor-released patch version has been independently confirmed from the available data. The vulnerability was reported by Ubuntu's security team, so monitoring Ubuntu Security Notices (https://ubuntu.com/security/notices) for a USN covering Mongoose is the recommended first step. Similarly, check the upstream Cesanta Mongoose GitHub repository for commits or releases addressing mg_tls_recv_cert bounds checking. As a compensating control, operators should restrict TLS endpoints built on Mongoose so that only trusted certificate authorities or pinned certificates are accepted, reducing the attacker's ability to present a malformed chain. If the application acts as a TLS server accepting client certificates (mTLS), disabling client certificate verification eliminates this attack surface at the cost of losing mutual authentication. Applications acting as TLS clients should ensure they connect only to trusted endpoints with validated server certificates to limit exposure on the client side.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today