EUVD-2026-18183Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 5.6 with high complexity (AC:H) and no privilege escalation required (PR:N) indicates moderate real-world risk. The CVSS vector includes RL:O (Remediation Level: Official fix available) and RC:C (Report Confidence: Confirmed), both favorable signals. EPSS reflects exploitation probability-the presence of publicly available proof-of-concept code (E:P in vector) elevates risk beyond the base score, though the high attack complexity and network-only attack vector (AV:N) limit opportunistic exploitation. Actively exploited status is not confirmed in the input data (no KEV reference provided), so this is classified as publicly disclosed with available POC rather than zero-day. The impact scope is unchanged (S:U), affecting only the vulnerable process, not the broader system. For Mongoose deployments exposed to untrusted network mDNS traffic (e.g., IoT devices on shared networks or cloud environments with multicast), this is a genuine priority; for isolated or unicast-only deployments, risk is lower. The vendor's rapid response (version 7.21 released) and professional engagement reduce overall organizational risk. |
| Exploit ScenarioDerived | An attacker on the same local network or with network access to a Mongoose instance crafts a malicious mDNS packet with specially formatted record data that exceeds expected buffer boundaries in the handle_mdns_record function. When Mongoose processes this packet, the buf parameter causes a stack overflow, potentially enabling memory corruption that crashes the service or, with careful payload construction, allows code execution. Publicly available exploit code demonstrates feasibility; however, high attack complexity (likely due to ASLR, stack canaries, or mDNS parsing logic) requires attacker sophistication. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 02, 2026
Stack-based buffer overflow in Cesanta Mongoose mDNS Record Handler (versions up to 7.20) allows remote attackers to trigger memory corruption via malformed mDNS record data in the handle_mdns_record function. The vulnerability requires high attack complexity and network-level access but results in limited confidentiality, integrity, and availability impact. Publicly available exploit code exists; vendor released patched version 7.21 with immediate availability.
RemediationAI
Vendor-released patch: upgrade Cesanta Mongoose to version 7.21 or later. The fix is available at https://github.com/cesanta/mongoose/releases/tag/7.21, with the commit hash 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1 for upstream verification. Immediately update all Mongoose-based applications and embedded systems to version 7.21. No workarounds are documented; patching is the only remediation. Verify the update by checking Mongoose version in application startup logs or embedded firmware manifests. For air-gapped or legacy deployments unable to upgrade immediately, restrict untrusted mDNS traffic at the network boundary (e.g., firewall rules blocking UDP 5353 from external sources).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the mDNS (Multicast DNS) record handling component of Mongoose, a lightweight embedded networking library. The root cause is a stack-based buffer overflow (CWE-121) in the handle_mdns_record function of mongoose.c, triggered by improper bounds checking when processing the buf argument during mDNS packet parsing. The affected CPE cpe:2.3:a:cesanta:mongoose:*:*:*:*:*:*:*:* indicates all Mongoose versions through 7.20 are vulnerable. mDNS operates at the application layer for service discovery and hostname resolution; the overflow occurs during record deserialization, allowing attackers on the network to craft malicious mDNS packets that overwrite stack memory adjacent to the vulnerable buffer.
Know when Mongoose gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was found in Cesanta Mongoose up to 7.20. This impacts the function handle_mdns_record of the file mongoose.c of the component mDNS Record Handler. Performing a manipulation of the argument buf results in stack-based buffer overflow. Remote exploitation of the attack is possible. A high degree of complexity is needed for the attack. The exploitability is said to be difficult. The exploit has been made public and could be used. Upgrading to version 7.21 will fix this issue. The patch is named 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Related Vulnerabilities in Cesanta Mongoose TLS and mDNS Handler Flaws
View all 3Mongoose ODM for Node.js before version 8.9.5 contains a search injection vulnerability when using $where filters with p
An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6
An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8. Rated crit
An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8.
An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8.
Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4. Rated critical severity (CVSS 9.8), this vu
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6. Rated critical severity (CVSS 9.8), this vu
An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infin
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. Rated critical severity (CVSS 9.1
The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 (compiled with OpenSSL support) is vulnerable to remote OO
The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable
The mg_http_serve_file function in Cesanta Mongoose HTTP server 7.0 is vulnerable to remote OOB write attack via connect
Exploit-DB