CVE-2026-5245
MediumCVSS 5.6Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
In Cesanta Mongoose up to 7.20, the handle_mdns_record function in mongoose.c (mDNS Record Handler component) contains a stack-based buffer overflow triggered by manipulation of the buf argument. Remote exploitation is possible but requires high complexity and is difficult; the exploit has been made public.
Risk Assessment
Despite the difficulty of exploitation, the publicly available exploit and remote triggerability increase the risk of crashes or potential code execution. This affects devices and applications using Mongoose.
Recommendation
Upgrade Cesanta Mongoose to version 7.21 containing the fix. Until patched, limit exposure of mDNS services to untrusted networks.
Other vulnerabilities in Cesanta Mongoose
See all- CVE-2017-2909High
An infinite loop programming error exists in the DNS server functionality of Cesanta Mongoose 6.8 library. A specially crafted DNS request can cause an infinite loop resulting in high CPU usage and Denial Of Service.
- CVE-2017-2895High
CVE-2017-2895 describes an exploitable arbitrary memory read vulnerability in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can lead to information disclosure and denial of service.
- CVE-2017-2893High
A NULL pointer dereference vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8, which can lead to server crashes. Sending a specially crafted MQTT SUBSCRIBE packet by an attacker can trigger this vulnerability.
- CVE-2017-2922Critical
CVE-2017-2922 describes a memory corruption vulnerability in the Websocket protocol implementation of Cesanta Mongoose 6.8. A specially crafted websocket packet can lead to a buffer being allocated with stale pointers, resulting in a use-after-free vulnerability that can be exploited for remote code execution.
- CVE-2017-2921Critical
CVE-2017-2921 describes a vulnerability in the Websocket protocol implementation of Cesanta Mongoose 6.8 that can lead to heap buffer overflow. A specially crafted websocket packet can cause an integer overflow, resulting in denial of service and potential remote code execution.
- CVE-2017-2894Critical
CVE-2017-2894 describes a stack buffer overflow vulnerability in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause a buffer overflow, leading to remote code execution.
- CVE-2017-2892Critical
An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT packet can cause an arbitrary out-of-bounds memory read and write potentially resulting in information disclosure, denial of service and remote code execution.
- CVE-2017-2891Critical
CVE-2017-2891 describes a use-after-free vulnerability in the HTTP server implementation of Cesanta Mongoose 6.8. An ordinary HTTP POST request with a CGI target can cause a reuse of previously freed pointer, potentially leading to remote code execution.
- CVE-2026-101003Medium
A weakness was identified in Cesanta Mongoose up to 7.21, affecting the fn function in tutorials/mqtt/mqtt-server/main.c (MQTT Broker component). Manipulation leads to a stack-based buffer overflow. The attack can be launched remotely and the exploit is publicly available. Upgrading to version 7.22 (patch a9df523f76f43a38bd53b4232b9cfd4c16869e71) addresses the issue.
- CVE-2026-11404High
Cesanta Mongoose before version 7.22 has an out-of-bounds read vulnerability in the mg_tls_server_recv_hello() function. An attacker can send a crafted ClientHello with an oversized session ID length, causing a read past the buffer and crashing HTTPS, MQTTS, or WSS services.
Original NVD description (English source)
A vulnerability was found in Cesanta Mongoose up to 7.20. This impacts the function handle_mdns_record of the file mongoose.c of the component mDNS Record Handler. Performing a manipulation of the argument buf results in stack-based buffer overflow. Remote exploitation of the attack is possible. A high degree of complexity is needed for the attack. The exploitability is said to be difficult. The exploit has been made public and could be used. Upgrading to version 7.21 will fix this issue. The patch is named 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS