Severity by source
Network vector; high complexity due to required MITM or rogue-server position; no privileges needed; OOB read yields limited memory disclosure and potential crash, no integrity impact.
Estimated by vuln.today — no official severity rating has been published for this CVE yet.
Lifecycle Timeline
1DescriptionCVE.org
[mg_tls_client_recv_hello size_t underflow in ext_len bounds check / mg_tls_client_recv_hello ext_len fixed-offset OOB read]
AnalysisAI
Out-of-bounds read in Mongoose's TLS client handshake parser exposes applications using the library's built-in TLS stack to memory disclosure or crash when connecting to a malicious or attacker-controlled TLS server. The flaw resides in mg_tls_client_recv_hello, where a size_t underflow in the ext_len bounds check allows a fixed-offset OOB read beyond the valid message buffer. Reported via an Ubuntu vendor advisory; no confirmed active exploitation or public exploit code has been identified at time of analysis.
Technical ContextAI
Mongoose is a compact C networking library by Cesanta used extensively in embedded systems and IoT devices, featuring a self-contained TLS implementation. The vulnerable function mg_tls_client_recv_hello processes TLS ServerHello messages on the client side during handshake. The ext_len variable, representing the byte length of TLS extension data, is of type size_t - an unsigned integer type in C. When a crafted ServerHello supplies an ext_len value smaller than the fixed offset subsequently used in bounds arithmetic, unsigned integer subtraction wraps around to a very large positive value, bypassing the intended bounds check entirely. The subsequent fixed-offset read then accesses memory beyond the valid buffer boundary. No CWE identifier was provided in the source data, but this pattern corresponds to CWE-191 (Integer Underflow/Wraparound) leading to CWE-125 (Out-of-bounds Read).
Affected ProductsAI
Mongoose (Cesanta) networking library, specifically versions containing the mg_tls_client_recv_hello function in the TLS client implementation. The exact affected version range was not specified in the provided data. The flaw was reported by the Ubuntu vendor, indicating that Ubuntu-packaged releases of Mongoose or software statically embedding Mongoose are affected. No CPE strings or vendor advisory URL were included in the source data; version bounds must be confirmed against an official Ubuntu Security Notice or the upstream Mongoose changelog.
RemediationAI
No vendor-released patch version or advisory URL was provided in the available data; this analysis cannot cite an exact fix version. Monitor Ubuntu Security Notices and the upstream Mongoose repository for an official patch and apply it once released. As compensating controls while a patch is pending: restrict Mongoose-based TLS clients to connect exclusively to explicitly trusted, certificate-verified servers, which limits exposure to malicious server inputs and reduces the MITM attack surface. Enforce strict server certificate validation - clients accepting unverified or self-signed certificates cannot be protected by server-restriction controls alone. In embedded or IoT deployments where outbound TLS client functionality is not required, disabling TLS client compilation via Mongoose build flags eliminates the vulnerable code path entirely, at the cost of removing TLS client capability. No patch version can be confirmed from the data provided; do not infer fix availability from this analysis alone.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today