# cesanta mongoose.

Every CVE that names cesanta mongoose among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Mongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c)](https://agentprime.io/advisories/CVE-2026-115473.md)
  `CVE-2026-115473` · CVE record: cesanta mongoose · CVSS 6.5 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Memory corruption, CWE-158
- [Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6)](https://agentprime.io/advisories/CVE-2026-63626.md)
  `CVE-2026-63626` · CVE record: cesanta mongoose · CVSS 8.8 High · Not analysed yet · Published 14 Oct 2026 · Tags: Memory corruption
- [Mongoose: handle_opt() missing opts\[1\] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connection](https://agentprime.io/advisories/CVE-2026-73261.md)
  `CVE-2026-73261` · CVE record: cesanta mongoose · CVSS 7.5 High · Not analysed yet · Published 14 Oct 2026 · Tags: Memory corruption, CWE-20
- [Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser](https://agentprime.io/advisories/CVE-2026-73260.md)
  `CVE-2026-73260` · CVE record: cesanta mongoose · CVSS 7.5 High · Not analysed yet · Published 14 Oct 2026 · Tags: Memory corruption
- [Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAX](https://agentprime.io/advisories/CVE-2026-73252.md)
  `CVE-2026-73252` · CVE record: cesanta mongoose · CVSS 7.5 High · Not analysed yet · Published 14 Oct 2026 · Tags: Memory corruption
- [Cesanta Mongoose MQTT Broker main.c fn stack-based overflow](https://agentprime.io/advisories/CVE-2026-101003.md)
  `CVE-2026-101003` · CVE record: Cesanta Mongoose · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Memory corruption
- [Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching](https://agentprime.io/advisories/CVE-2026-73253.md)
  `CVE-2026-73253` · CVE record: cesanta mongoose · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: Weak cryptography or TLS
- [Mongoose: Path traversal in SSI #include directives enables arbitrary file read](https://agentprime.io/advisories/CVE-2026-73255.md)
  `CVE-2026-73255` · CVE record: cesanta mongoose · CVSS 6.5 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Path traversal
- [Mongoose: Reflected XSS via decoded URI in directory listing render](https://agentprime.io/advisories/CVE-2026-73259.md)
  `CVE-2026-73259` · CVE record: cesanta mongoose · CVSS 5.4 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Cross-site scripting (XSS)
- [Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE](https://agentprime.io/advisories/CVE-2026-73256.md)
  `CVE-2026-73256` · CVE record: cesanta mongoose · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: HTTP request smuggling
- [Mongoose: Stored XSS via unescaped filenames in directory listing](https://agentprime.io/advisories/CVE-2026-73254.md)
  `CVE-2026-73254` · CVE record: cesanta mongoose · CVSS 5.4 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: Cross-site scripting (XSS)
- [Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart](https://agentprime.io/advisories/CVE-2026-73258.md)
  `CVE-2026-73258` · CVE record: cesanta mongoose · CVSS 6.5 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: CWE-697
- [Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification](https://agentprime.io/advisories/CVE-2026-73251.md)
  `CVE-2026-73251` · CVE record: cesanta mongoose · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: Weak cryptography or TLS
- [Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling](https://agentprime.io/advisories/CVE-2026-73257.md)
  `CVE-2026-73257` · CVE record: cesanta mongoose · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: HTTP request smuggling
- [Cesanta Mongoose Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID Parsing](https://agentprime.io/advisories/CVE-2026-11404.md)
  `CVE-2026-11404` · CVE record: Cesanta Mongoose · CVSS 8.7 High · Not analysed yet · Published 9 Jul 2026 · Tags: Memory corruption
- [Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verification](https://agentprime.io/advisories/CVE-2026-6986.md)
  `CVE-2026-6986` · CVE record: Cesanta Mongoose · CVSS 6.3 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Weak cryptography or TLS, CWE-345
- [Cesanta Mongoose TCP Option net_builtin.c handle_opt infinite loop](https://agentprime.io/advisories/CVE-2026-6985.md)
  `CVE-2026-6985` · CVE record: Cesanta Mongoose · CVSS 6.9 Medium · Not analysed yet · Published 25 Apr 2026 · Tags: Denial of service
- [Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization](https://agentprime.io/advisories/CVE-2026-5246.md)
  `CVE-2026-5246` · CVE record: Cesanta Mongoose · CVSS 6.3 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: Broken access control
- [Cesanta Mongoose mDNS Record mongoose.c handle_mdns_record stack-based overflow](https://agentprime.io/advisories/CVE-2026-5245.md)
  `CVE-2026-5245` · CVE record: Cesanta Mongoose · CVSS 6.3 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: Memory corruption
- [Cesanta Mongoose TLS 1.3 mongoose.c mg_tls_recv_cert heap-based overflow](https://agentprime.io/advisories/CVE-2026-5244.md)
  `CVE-2026-5244` · CVE record: Cesanta Mongoose · CVSS 6.9 Medium · Not analysed yet · Published 2 Apr 2026 · Tags: Memory corruption
- [Cesanta Mongoose Poly1305 Authentication Tag tls_chacha20.c mg_chacha20_poly1305_decrypt signature verification](https://agentprime.io/advisories/CVE-2026-2968.md)
  `CVE-2026-2968` · CVE record: Cesanta Mongoose · CVSS 6.3 Medium · Not analysed yet · Published 23 Feb 2026 · Tags: Weak cryptography or TLS, CWE-345
- [Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of source](https://agentprime.io/advisories/CVE-2026-2967.md)
  `CVE-2026-2967` · CVE record: Cesanta Mongoose · CVSS 6.3 Medium · Not analysed yet · Published 23 Feb 2026 · Tags: CWE-940
- [Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values](https://agentprime.io/advisories/CVE-2026-2966.md)
  `CVE-2026-2966` · CVE record: Cesanta Mongoose · CVSS 6.3 Medium · Not analysed yet · Published 23 Feb 2026 · Tags: Weak cryptography or TLS, CWE-310
- [Cesanta Mongoose MQTT Message Parsing Heap Overflow](https://agentprime.io/advisories/CVE-2023-2905.md)
  `CVE-2023-2905` · CVE record: Cesanta Mongoose · No CVSS score · Not analysed yet · Published 9 Aug 2023 · Tags: Memory corruption
- [Arbitrary File Write](https://agentprime.io/advisories/CVE-2022-25299.md)
  `CVE-2022-25299` · CVE record: cesanta/mongoose · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 18 Feb 2022
- [Cesanta Mongoose: An exploitable memory corruption vulnerability exists in the Websocket protocol…](https://agentprime.io/advisories/CVE-2017-2922.md)
  `CVE-2017-2922` · CVE record: Cesanta Mongoose · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Nov 2017
- [Cesanta Mongoose: An exploitable memory corruption vulnerability exists in the Websocket protocol…](https://agentprime.io/advisories/CVE-2017-2921.md)
  `CVE-2017-2921` · CVE record: Cesanta Mongoose · CVSS 8.1 High · Not analysed yet · Published 7 Nov 2017
- [Cesanta Mongoose: An infinite loop programming error exists in the DNS server functionality of Cesanta…](https://agentprime.io/advisories/CVE-2017-2909.md)
  `CVE-2017-2909` · CVE record: Cesanta Mongoose · CVSS 7.5 High · Not analysed yet · Published 7 Nov 2017
- [Cesanta Mongoose: An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing…](https://agentprime.io/advisories/CVE-2017-2895.md)
  `CVE-2017-2895` · CVE record: Cesanta Mongoose · CVSS 8.2 High · Not analysed yet · Published 7 Nov 2017
- [Cesanta Mongoose: An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing…](https://agentprime.io/advisories/CVE-2017-2894.md)
  `CVE-2017-2894` · CVE record: Cesanta Mongoose · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.31 · Not analysed yet · Published 7 Nov 2017
- [Cesanta Mongoose: An exploitable NULL pointer dereference vulnerability exists in the MQTT packet parsing…](https://agentprime.io/advisories/CVE-2017-2893.md)
  `CVE-2017-2893` · CVE record: Cesanta Mongoose · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.25 · Not analysed yet · Published 7 Nov 2017
- [Cesanta Mongoose: An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing…](https://agentprime.io/advisories/CVE-2017-2892.md)
  `CVE-2017-2892` · CVE record: Cesanta Mongoose · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Nov 2017
- [Cesanta Mongoose: An exploitable use-after-free vulnerability exists in the HTTP server implementation of…](https://agentprime.io/advisories/CVE-2017-2891.md)
  `CVE-2017-2891` · CVE record: Cesanta Mongoose · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Nov 2017

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=cesanta-mongoose>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/cesanta-mongoose/>. Everything for agents: <https://agentprime.io/llms.txt>.