18
CVEs
3
Critical
2
High
0
KEV
8
PoC
0
Unpatched C/H
83.3%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
2
MEDIUM
7
LOW
6
Monthly CVE Trend
Affected Products (7)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-6985 | Remote denial of service in Cesanta Mongoose up to version 7.20 allows unauthenticated attackers to trigger an infinite loop via manipulation of TCP option length parameters in the handle_opt function, causing service unavailability. Publicly available exploit code exists. Patch released in version 7.21. | MEDIUM | 5.5 | 0.0% | 48 |
PoC
|
| CVE-2026-73256 | HTTP request smuggling in Cesanta Mongoose embedded web server/network library before 7.22 lets a remote unauthenticated attacker desynchronize an HTTP/1.0 reverse-proxy front-end from the Mongoose back-end. A buggy length check in http_cb() (src/http.c) never sets is_http_1_0, so Mongoose honors Transfer-Encoding: chunked framing that an HTTP/1.0 proxy ignores, allowing the attacker to smuggle requests past the proxy and reach unauthorized functionality or alter application state. Rated CVSS 9.1; a vendor patch exists (7.22), but no public exploit and no EPSS/KEV data were provided at time of analysis. | CRITICAL | 9.1 | 0.4% | 46 |
|
| CVE-2026-73257 | HTTP request smuggling (CL.TE desynchronization) in Cesanta Mongoose embedded web server before 7.22 lets a remote unauthenticated attacker craft a request bearing both Content-Length and Transfer-Encoding: chunked headers. Because mg_http_parse()/http_cb() accept both and prioritize chunked encoding while a front-end reverse proxy that prefers Content-Length draws a different request boundary, an attacker can smuggle a second request that reads or modifies resources belonging to another user's context. No public exploit is identified at time of analysis; the issue is fixed in 7.22 which rejects requests containing both headers. | CRITICAL | 9.1 | 0.4% | 46 |
|
| CVE-2026-73253 | TLS hostname verification bypass in Cesanta Mongoose's built-in TLS stack (versions prior to 7.22) lets an on-path attacker holding a wildcard certificate for a parent domain impersonate arbitrarily deep subdomains, defeating certificate validation for clients that use the embedded TLS backend. The flaw stems from mg_match() wildcards crossing DNS label boundaries, so *.example.com wrongly matches foo.bar.example.com. A vendor patch exists in 7.22, but no public exploit identified at time of analysis. | CRITICAL | 9.1 | 0.2% | 46 |
|
| CVE-2026-11404 | Denial of service in Cesanta Mongoose before 7.22 lets a remote, unauthenticated attacker crash any TLS service (HTTPS, MQTTS, or WSS) built on the MG_TLS_BUILTIN stack by sending a single crafted TLS ClientHello whose session_id_len byte is used as an unvalidated buffer index, triggering an out-of-bounds read. The flaw sits in the built-in TLS server handshake function mg_tls_server_recv_hello() and requires no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trigger is trivial and the issue was disclosed by VulnCheck. | HIGH | 8.7 | 0.4% | 44 |
|
| CVE-2026-2967 | A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This affects the function getpeer of the file /src/net_builtin.c of the component TCP Sequence Number Handler. [CVSS 3.7 LOW] | LOW | 2.9 | 0.1% | 35 |
PoC
No patch
|
| CVE-2026-2966 | A weakness has been identified in Cesanta Mongoose up to 7.20. The impacted element is the function mg_sendnsreq of the file /src/dns.c of the component DNS Transaction ID Handler. [CVSS 3.7 LOW] | LOW | 2.9 | 0.1% | 35 |
PoC
No patch
|
| CVE-2026-5245 | Stack-based buffer overflow in Cesanta Mongoose mDNS Record Handler (versions up to 7.20) allows remote attackers to trigger memory corruption via malformed mDNS record data in the handle_mdns_record function. The vulnerability requires high attack complexity and network-level access but results in limited confidentiality, integrity, and availability impact. Publicly available exploit code exists; vendor released patched version 7.21 with immediate availability. | LOW | 2.9 | 0.1% | 35 |
PoC
|
| CVE-2026-6986 | Improper verification of cryptographic signatures in Cesanta Mongoose versions up to 7.20 allows remote attackers to bypass GCM authentication tag validation in the mg_aes_gcm_decrypt function. The vulnerability has high attack complexity and requires no user interaction, but provides only integrity impact (not confidentiality or availability). Publicly available exploit code exists, and vendor has released patched version 7.21. | LOW | 2.9 | 0.0% | 35 |
PoC
|
| CVE-2026-2968 | A vulnerability was detected in Cesanta Mongoose up to 7.20. This impacts the function mg_chacha20_poly1305_decrypt of the file /src/tls_chacha20.c of the component Poly1305 Authentication Tag Handler. The manipulation results in improper verification of cryptographic signature. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is said to be difficult. The exploit is now public and may be used. The vendor was contacted early about this di... | LOW | 2.9 | 0.0% | 35 |
PoC
No patch
|
| CVE-2026-73255 | Path traversal in Cesanta Mongoose's SSI processing allows an authenticated network attacker to read arbitrary files accessible to the Mongoose process by embedding directory traversal sequences in #include file or #include virtual SSI directives. The mg_ssi() function in src/ssi.c constructs filesystem paths from directive arguments without invoking the existing mg_path_is_sane() validation, bypassing the only guard against traversal. Exploitation is constrained to deployments compiled with MG_ENABLE_SSI and a configured ssi_pattern; no public exploit has been identified at time of analysis. | MEDIUM | 6.5 | 0.6% | 33 |
|
| CVE-2026-73258 | Multipart body parsing in Cesanta Mongoose before 7.22 can be manipulated by a remote unauthenticated attacker to truncate headers, filenames, or boundary values through injection of a lone carriage return or line feed. The logic error in mg_http_next_multipart() causes CRLF-scanning loops to terminate prematurely on any single CR or LF character rather than requiring the full two-byte CRLF sequence, enabling content-type spoofing that can cause downstream application logic to accept dangerous or disallowed content. No CISA KEV listing or public proof-of-concept has been identified at time of analysis; the fix is confirmed in release 7.22. | MEDIUM | 6.5 | 0.3% | 33 |
|
| CVE-2026-5244 | Heap-based buffer overflow in Cesanta Mongoose versions up to 7.20 allows unauthenticated remote attackers to compromise confidentiality, integrity, and availability through malicious TLS 1.3 handshake manipulation. The vulnerability resides in mg_tls_recv_cert() function's improper handling of the pubkey argument during certificate processing. Publicly available exploit code exists (CVSS temporal E:P), and vendor-released patch is available in version 7.21. CVSS base score 7.3 reflects network-accessible, low-complexity attack requiring no privileges or user interaction. | MEDIUM | 5.5 | 0.1% | 28 |
|
| CVE-2026-73259 | Reflected cross-site scripting in Cesanta Mongoose (all versions prior to 7.22) allows a remote unauthenticated attacker to inject arbitrary JavaScript into a victim's browser by crafting a percent-encoded URL path targeting the directory listing handler. The `mg_http_serve_dir()` and `listdir()` functions in `src/http.c` insert the decoded request URI directly into `<title>` and `<h1>` HTML elements without HTML entity escaping, and the resulting script executes in the Mongoose origin. Exploitation requires both that the server was compiled with `MG_ENABLE_DIRLIST` enabled and that a victim user is persuaded to visit the malicious link; no public exploit or CISA KEV listing is identified at time of analysis. | MEDIUM | 5.4 | 0.2% | 27 |
|
| CVE-2026-73254 | Stored cross-site scripting in Cesanta Mongoose's directory listing feature allows an attacker with filesystem write access to a served directory to plant a file whose name contains HTML or JavaScript markup; when any user browses that directory, the raw filename is reflected into the HTML page without escaping, executing arbitrary script in the Mongoose origin. All Mongoose versions prior to 7.22 with MG_ENABLE_DIRLIST enabled are affected. No public exploit or CISA KEV listing is confirmed at time of analysis; the vendor-released fix is available in Mongoose 7.22. | MEDIUM | 5.4 | 0.2% | 27 |
|