agentprime: cesanta-mongooseEvery new CVE for cesanta-mongoose.https://agentprime.io/CVE-2026-115473: Mongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c)https://agentprime.io/advisories/CVE-2026-115473/https://agentprime.io/advisories/CVE-2026-115473/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Nov 2026 21:40:39 GMTCVECVE-2026-63626: Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6)https://agentprime.io/advisories/CVE-2026-63626/https://agentprime.io/advisories/CVE-2026-63626/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 18:26:16 GMTCVECVE-2026-73261: Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connectionhttps://agentprime.io/advisories/CVE-2026-73261/https://agentprime.io/advisories/CVE-2026-73261/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 18:25:41 GMTCVECVE-2026-73260: Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parserhttps://agentprime.io/advisories/CVE-2026-73260/https://agentprime.io/advisories/CVE-2026-73260/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 18:25:00 GMTCVECVE-2026-73252: Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAXhttps://agentprime.io/advisories/CVE-2026-73252/https://agentprime.io/advisories/CVE-2026-73252/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 18:24:16 GMTCVECVE-2026-101003: Cesanta Mongoose MQTT Broker main.c fn stack-based overflowhttps://agentprime.io/advisories/CVE-2026-101003/https://agentprime.io/advisories/CVE-2026-101003/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 28 Sep 2026 05:30:14 GMTCVECVE-2026-73253: Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matchinghttps://agentprime.io/advisories/CVE-2026-73253/https://agentprime.io/advisories/CVE-2026-73253/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Aug 2026 17:41:02 GMTCVEcriticalCVE-2026-73255: Mongoose: Path traversal in SSI #include directives enables arbitrary file readhttps://agentprime.io/advisories/CVE-2026-73255/https://agentprime.io/advisories/CVE-2026-73255/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Aug 2026 17:40:02 GMTCVECVE-2026-73259: Mongoose: Reflected XSS via decoded URI in directory listing renderhttps://agentprime.io/advisories/CVE-2026-73259/https://agentprime.io/advisories/CVE-2026-73259/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Aug 2026 17:39:16 GMTCVECVE-2026-73256: Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TEhttps://agentprime.io/advisories/CVE-2026-73256/https://agentprime.io/advisories/CVE-2026-73256/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Aug 2026 17:37:54 GMTCVEcriticalCVE-2026-73254: Mongoose: Stored XSS via unescaped filenames in directory listinghttps://agentprime.io/advisories/CVE-2026-73254/https://agentprime.io/advisories/CVE-2026-73254/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Aug 2026 17:37:17 GMTCVECVE-2026-73258: Mongoose: Multipart boundary/header scan logic error in mg_http_next_multiparthttps://agentprime.io/advisories/CVE-2026-73258/https://agentprime.io/advisories/CVE-2026-73258/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Aug 2026 17:36:39 GMTCVECVE-2026-73251: Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verificationhttps://agentprime.io/advisories/CVE-2026-73251/https://agentprime.io/advisories/CVE-2026-73251/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Aug 2026 17:34:50 GMTCVEcriticalCVE-2026-73257: Mongoose: Content-Length + Transfer-Encoding coexistence enables request smugglinghttps://agentprime.io/advisories/CVE-2026-73257/https://agentprime.io/advisories/CVE-2026-73257/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Aug 2026 17:30:58 GMTCVEcriticalCVE-2026-11404: Cesanta Mongoose Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID Parsinghttps://agentprime.io/advisories/CVE-2026-11404/https://agentprime.io/advisories/CVE-2026-11404/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 09 Jul 2026 15:13:40 GMTCVECVE-2026-6986: Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verificationhttps://agentprime.io/advisories/CVE-2026-6986/https://agentprime.io/advisories/CVE-2026-6986/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 25 Apr 2026 16:30:13 GMTCVECVE-2026-6985: Cesanta Mongoose TCP Option net_builtin.c handle_opt infinite loophttps://agentprime.io/advisories/CVE-2026-6985/https://agentprime.io/advisories/CVE-2026-6985/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 25 Apr 2026 16:15:13 GMTCVECVE-2026-5246: Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorizationhttps://agentprime.io/advisories/CVE-2026-5246/https://agentprime.io/advisories/CVE-2026-5246/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 02 Apr 2026 09:45:11 GMTCVECVE-2026-5245: Cesanta Mongoose mDNS Record mongoose.c handle_mdns_record stack-based overflowhttps://agentprime.io/advisories/CVE-2026-5245/https://agentprime.io/advisories/CVE-2026-5245/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 02 Apr 2026 09:00:19 GMTCVECVE-2026-5244: Cesanta Mongoose TLS 1.3 mongoose.c mg_tls_recv_cert heap-based overflowhttps://agentprime.io/advisories/CVE-2026-5244/https://agentprime.io/advisories/CVE-2026-5244/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 02 Apr 2026 08:00:19 GMTCVECVE-2026-2968: Cesanta Mongoose Poly1305 Authentication Tag tls_chacha20.c mg_chacha20_poly1305_decrypt signature verificationhttps://agentprime.io/advisories/CVE-2026-2968/https://agentprime.io/advisories/CVE-2026-2968/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 23 Feb 2026 03:02:07 GMTCVECVE-2026-2967: Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of sourcehttps://agentprime.io/advisories/CVE-2026-2967/https://agentprime.io/advisories/CVE-2026-2967/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 23 Feb 2026 02:32:07 GMTCVECVE-2026-2966: Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random valueshttps://agentprime.io/advisories/CVE-2026-2966/https://agentprime.io/advisories/CVE-2026-2966/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 23 Feb 2026 02:02:08 GMTCVECVE-2023-2905: Cesanta Mongoose MQTT Message Parsing Heap Overflowhttps://agentprime.io/advisories/CVE-2023-2905/https://agentprime.io/advisories/CVE-2023-2905/Published by the CVE Program. Not analysed by agentprime yet.Wed, 09 Aug 2023 04:46:14 GMTCVECVE-2022-25299: Arbitrary File Writehttps://agentprime.io/advisories/CVE-2022-25299/https://agentprime.io/advisories/CVE-2022-25299/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Feb 2022 12:55:21 GMTCVEcriticalCVE-2017-2922: Cesanta Mongoose: An exploitable memory corruption vulnerability exists in the Websocket protocol…https://agentprime.io/advisories/CVE-2017-2922/https://agentprime.io/advisories/CVE-2017-2922/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Nov 2017 16:00:00 GMTCVEcriticalCVE-2017-2921: Cesanta Mongoose: An exploitable memory corruption vulnerability exists in the Websocket protocol…https://agentprime.io/advisories/CVE-2017-2921/https://agentprime.io/advisories/CVE-2017-2921/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Nov 2017 16:00:00 GMTCVECVE-2017-2909: Cesanta Mongoose: An infinite loop programming error exists in the DNS server functionality of Cesanta…https://agentprime.io/advisories/CVE-2017-2909/https://agentprime.io/advisories/CVE-2017-2909/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Nov 2017 16:00:00 GMTCVECVE-2017-2895: Cesanta Mongoose: An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing…https://agentprime.io/advisories/CVE-2017-2895/https://agentprime.io/advisories/CVE-2017-2895/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Nov 2017 16:00:00 GMTCVECVE-2017-2894: Cesanta Mongoose: An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing…https://agentprime.io/advisories/CVE-2017-2894/https://agentprime.io/advisories/CVE-2017-2894/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. CVSS score 9.8 (7.0 or more) and EPSS 0.31 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Nov 2017 16:00:00 GMTCVEcriticalCVE-2017-2893: Cesanta Mongoose: An exploitable NULL pointer dereference vulnerability exists in the MQTT packet parsing…https://agentprime.io/advisories/CVE-2017-2893/https://agentprime.io/advisories/CVE-2017-2893/CVSS 7.5 (High). Critical: CVSS score 7.5 (7.0 or more) and EPSS 0.25 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Nov 2017 16:00:00 GMTCVEcriticalCVE-2017-2892: Cesanta Mongoose: An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing…https://agentprime.io/advisories/CVE-2017-2892/https://agentprime.io/advisories/CVE-2017-2892/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Nov 2017 16:00:00 GMTCVEcriticalCVE-2017-2891: Cesanta Mongoose: An exploitable use-after-free vulnerability exists in the HTTP server implementation of…https://agentprime.io/advisories/CVE-2017-2891/https://agentprime.io/advisories/CVE-2017-2891/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Nov 2017 16:00:00 GMTCVEcritical