Which versions of Mongoose are affected by CVE-2026-5244?

Cesanta Mongoose versions up to 7.20 contain a heap-based buffer overflow in TLS 1.3 certificate processing that allows unauthenticated remote attackers to compromise system confidentiality,…. A patch is available.

How to fix or mitigate CVE-2026-5244?

Within 24 hours: Identify all systems running Cesanta Mongoose versions 7.20 and earlier through vulnerability scanning and asset inventory; isolate or restrict network access to affected instances pending patching. Within 7 days: Deploy Cesanta Mongoose version 7.21 or later across all affected systems, prioritizing internet-facing and production environments. Within 30 days: Verify patch deployment through configuration audits, update change logs, and validate functionality post-upgrade; conduct threat hunting for exploitation indicators in network logs from the past 90 days.

Mongoose CVE-2026-5244

Q: What is the CVSS score of CVE-2026-5244?

CVE-2026-5244 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-18170 MEDIUM

Heap-based Buffer Overflow (CWE-122)

2026-04-02 VulDB

Buffer Overflow Heap Overflow Mongoose

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

EUVD ID Assigned

Apr 02, 2026 - 08:15 euvd

EUVD-2026-18170

Analysis Generated

Apr 02, 2026 - 08:15 vuln.today

Patch released

Apr 02, 2026 - 08:15 nvd

Patch available

CVE Published

Apr 02, 2026 - 08:00 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mongoose.c of the component TLS 1.3 Handler. Such manipulation of the argument pubkey leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.21 mitigates this issue. The name of the patch is 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

AnalysisAI

Heap-based buffer overflow in Cesanta Mongoose versions up to 7.20 allows unauthenticated remote attackers to compromise confidentiality, integrity, and availability through malicious TLS 1.3 handshake manipulation. The vulnerability resides in mg_tls_recv_cert() function's improper handling of the pubkey argument during certificate processing. Publicly available exploit code exists (CVSS temporal E:P), and vendor-released patch is available in version 7.21. CVSS base score 7.3 reflects network-accessible, low-complexity attack requiring no privileges or user interaction.

Technical ContextAI

Cesanta Mongoose is a lightweight embedded web server and networking library commonly used in IoT devices, embedded systems, and network appliances. The vulnerability (CWE-122: Heap-based Buffer Overflow) occurs in the TLS 1.3 protocol handler within mongoose.c, specifically in the mg_tls_recv_cert() function responsible for processing certificate data during the TLS handshake. When parsing the pubkey argument from incoming certificate messages, insufficient bounds checking allows an attacker to write beyond allocated heap memory. This classic memory corruption flaw can occur when the library processes malformed or oversized public key data structures in X.509 certificates presented during TLS 1.3 session establishment. The affected component (cpe:2.3:a:cesanta:mongoose:*:*:*:*:*:*:*:*) impacts all Mongoose versions through 7.20.

RemediationAI

Upgrade immediately to Cesanta Mongoose version 7.21 or later, which contains the complete fix via commit 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1 addressing the heap overflow in mg_tls_recv_cert() function. Download the patched release from https://github.com/cesanta/mongoose/releases/tag/7.21 or apply the specific commit patch from https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1 if building from source. If immediate upgrade is not feasible, consider temporary risk mitigation by disabling TLS 1.3 support if operationally acceptable, restricting network access to Mongoose-based services to trusted clients only, or deploying network-layer filtering to inspect TLS handshakes for anomalous certificate structures. Verify patched version deployment and conduct regression testing to ensure TLS functionality remains intact post-upgrade. The vendor responded professionally with rapid patch turnaround, making upgrade the strongly preferred remediation path over workarounds.