Cesanta Mongoose vulnerabilities

Mongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c)

cesanta · mongoose

Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6)

cesanta · mongoose

Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connection

cesanta · mongoose

Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser

cesanta · mongoose

Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAX

cesanta · mongoose

Cesanta Mongoose MQTT Broker main.c fn stack-based overflow

Cesanta · Mongoose

Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching

cesanta · mongoose

Mongoose: Path traversal in SSI #include directives enables arbitrary file read

cesanta · mongoose

Mongoose: Reflected XSS via decoded URI in directory listing render

cesanta · mongoose

Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE

cesanta · mongoose