Cesanta Mongoose CVE-2026-6985

The vulnerability is triggered by remote delivery of a specially crafted TCP packet with a manipulated optlen value in the TCP option header during the connection establishment phase. No special authentication, user interaction, or non-default configuration is required; default Mongoose instances listening on network interfaces are vulnerable. The attack succeeds against any Mongoose deployment version 7.20 or earlier that exposes TCP services to untrusted networks. Limitations on exploitation: (1) the infinite loop is bound by TCP connection timeout mechanisms (typically 30-120 seconds depending on OS configuration), after which the connection is torn down and CPU is released; (2) modern systems with process resource limits or container orchestration may automatically restart crashed/hung services, limiting sustained impact; (3) intrusion detection systems or network firewalls with deep packet inspection may detect and filter malformed TCP options, though this depends on deployment posture.

CVSS score of 5.3 with AV:N/AC:L/PR:N/UI:N reflects a network-accessible denial of service with no special privileges or user interaction required, but limited impact (availability only; no confidentiality or integrity loss). The CVSS vector includes E:P (Proof of Concept available) and RL:O (Official Fix available), strengthening evidence of real-world exploitability. However, CVSS base score of 5.3 falls below critical thresholds; the real-world risk depends on deployment context: embedded systems with limited redundancy face higher operational impact than cloud-hosted instances with auto-scaling. No EPSS or CVSS temporal/environmental modifiers provided, but the combination of network-accessible DoS plus public POC warrants prioritized patching in externally-facing deployments. The infinite loop is automatable and requires no user interaction, making it a straightforward target for vulnerability scanning and exploitation by both opportunistic and targeted attackers.

An attacker crafts a TCP SYN packet with a malformed TCP option header where the optlen parameter is set to a value that causes the handle_opt parser to loop indefinitely. The attacker sends this packet to the Mongoose server's listening port from any network-accessible location without authentication. The server consumes CPU in the infinite loop, becoming unresponsive to legitimate requests until the connection times out or manual intervention restarts the process. Repeated attacks amplify the denial of service across multiple connections.