CVE-2026-2966 Details
Description
A weakness has been identified in Cesanta Mongoose up to 7.20. The impacted element is the function mg_sendnsreq of the file /src/dns.c of the component DNS Transaction ID Handler. Executing a manipulation of the argument random can lead to insufficiently random values. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is regarded as difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability in Cesanta Mongoose versions through 7.20 allows for DNS spoofing attacks by exploiting predictable transaction IDs in the DNS request handling. The issue arises in the 'mg_sendnsreq' function within the 'src/dns.c' file, where transaction IDs are generated using a sequential counter that resets to 1 when the request list is empty. This flaw creates a constant transaction ID of 1 for all non-overlapping DNS queries, enabling attackers to reliably spoof DNS responses without prior traffic observation. The vulnerability can be exploited remotely by sending UDP packets with a spoofed source IP, bypassing DNS authentication and gaining control over hostname resolution. This could lead to man-in-the-middle attacks, credential theft, or redirection to malicious servers.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dwBruijn/CVEs/blob/main/Mongoose/mg_sendnsreq.md | [email protected] | ExploitThird Party Advisory |
| https://github.com/dwBruijn/CVEs/blob/main/Mongoose/mg_sendnsreq.md#poc | [email protected] | ExploitThird Party Advisory |
| https://vuldb.com/?ctiid.347333 | [email protected] | Permissions RequiredVDB Entry |
| https://vuldb.com/?id.347333 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/?submit.755304 | [email protected] | Third Party AdvisoryVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-310 | Cryptographic Issues | [email protected] |
| CWE-330 | Use of Insufficiently Random Values | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cesanta mongoose | <= 7.20 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Feb 23, 2026 | Initial Analysis | [email protected] |
| Feb 23, 2026 | New CVE Received | [email protected] |