Cesanta Mongoose EUVD-2026-42605

The target must run a TLS server endpoint (HTTPS, MQTTS, or WSS) built with Mongoose's built-in TLS stack (MG_TLS_BUILTIN) on a version before 7.22; the only prerequisite is network reachability of that TLS listener. No authentication, no user interaction, and no non-default handshake option are needed - the attacker simply sets an oversized session_id_len in a standard ClientHello. Exploitation is limited to deployments that actually use MG_TLS_BUILTIN: builds linking mbedTLS or OpenSSL instead of the built-in TLS are not affected, and devices whose TLS ports are firewalled to trusted networks are not remotely reachable.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms this is network-reachable, low-complexity, unauthenticated, and requires no user interaction - an attacker only needs to reach the TLS listener. Impact is availability-only: the 4.0 vector sets VC:N/VI:N/VA:H, so despite the 'Information Disclosure' tag this is realistically a crash/DoS rather than a confirmed data-leak primitive; treat the info-disclosure characterization as unconfirmed by the scoring. The 8.7 (High) base score is driven entirely by easy remote availability impact. No EPSS score, KEV listing, or public POC was provided, so real-world exploitation pressure is currently low-to-moderate: the barrier to weaponizing a one-packet crash is minimal, but there is no evidence of active exploitation. This is a genuine priority for internet-exposed embedded/IoT devices running the built-in TLS stack, where a single ClientHello can take a service offline, but lower priority for deployments that use mbedTLS/OpenSSL instead of MG_TLS_BUILTIN.

An attacker locates an internet-exposed embedded device serving HTTPS, MQTTS, or WSS via Mongoose's built-in TLS, then sends a single crafted TLS ClientHello whose session_id length byte exceeds the received data length. The malformed handshake causes mg_tls_server_recv_hello() to read past the receive buffer and crash the service, denying availability with one unauthenticated packet; no public POC is currently identified but the trigger is trivial to reproduce.