cesanta mongoose.

Mongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c)

• cesanta mongoose
• Memory corruption
• CWE-158

Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6)

• cesanta mongoose
• Memory corruption

Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connection

• cesanta mongoose
• Memory corruption
• CWE-20

Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser

• cesanta mongoose
• Memory corruption

Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAX

• cesanta mongoose
• Memory corruption

Cesanta Mongoose MQTT Broker main.c fn stack-based overflow

• Cesanta Mongoose
• Memory corruption

Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching

• cesanta mongoose
• Weak cryptography or TLS

Mongoose: Path traversal in SSI #include directives enables arbitrary file read

• cesanta mongoose
• Path traversal

Mongoose: Reflected XSS via decoded URI in directory listing render

• cesanta mongoose
• Cross-site scripting (XSS)

Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE

• cesanta mongoose
• HTTP request smuggling

Mongoose: Stored XSS via unescaped filenames in directory listing

• cesanta mongoose
• Cross-site scripting (XSS)

Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart

• cesanta mongoose
• CWE-697

Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification

• cesanta mongoose
• Weak cryptography or TLS

Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling

• cesanta mongoose
• HTTP request smuggling

Cesanta Mongoose Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID Parsing

• Cesanta Mongoose
• Memory corruption

Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verification

• Cesanta Mongoose
• Weak cryptography or TLS
• CWE-345

Cesanta Mongoose TCP Option net_builtin.c handle_opt infinite loop

• Cesanta Mongoose
• Denial of service

Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization

• Cesanta Mongoose
• Broken access control

Cesanta Mongoose mDNS Record mongoose.c handle_mdns_record stack-based overflow

• Cesanta Mongoose
• Memory corruption

Cesanta Mongoose TLS 1.3 mongoose.c mg_tls_recv_cert heap-based overflow

• Cesanta Mongoose
• Memory corruption

Cesanta Mongoose Poly1305 Authentication Tag tls_chacha20.c mg_chacha20_poly1305_decrypt signature verification

• Cesanta Mongoose
• Weak cryptography or TLS
• CWE-345

Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of source

• Cesanta Mongoose
• CWE-940

Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values

• Cesanta Mongoose
• Weak cryptography or TLS
• CWE-310

Cesanta Mongoose MQTT Message Parsing Heap Overflow

• Cesanta Mongoose
• Memory corruption

Arbitrary File Write

• cesanta/mongoose

Cesanta Mongoose: An exploitable memory corruption vulnerability exists in the Websocket protocol…

• Cesanta Mongoose

Cesanta Mongoose: An exploitable memory corruption vulnerability exists in the Websocket protocol…

• Cesanta Mongoose

Cesanta Mongoose: An infinite loop programming error exists in the DNS server functionality of Cesanta…

• Cesanta Mongoose

Cesanta Mongoose: An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing…

• Cesanta Mongoose

Cesanta Mongoose: An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing…

• Cesanta Mongoose

Cesanta Mongoose: An exploitable NULL pointer dereference vulnerability exists in the MQTT packet parsing…

• Cesanta Mongoose

Cesanta Mongoose: An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing…

• Cesanta Mongoose

Cesanta Mongoose: An exploitable use-after-free vulnerability exists in the HTTP server implementation of…

• Cesanta Mongoose