CVE-2026-5244 Details
Description
A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mongoose.c of the component TLS 1.3 Handler. Such manipulation of the argument pubkey leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.21 mitigates this issue. The name of the patch is 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
A heap-based buffer overflow vulnerability has been identified in Cesanta Mongoose versions prior to 7.21. The issue arises in the TLS 1.3 Handler, specifically within the `mg_tls_recv_cert` function in `mongoose.c`. The vulnerability allows for remote exploitation by manipulating the `pubkey` argument, leading to a buffer overflow that overwrites adjacent memory on the heap. This vulnerability has been publicly disclosed and is actively exploitable, with a proof-of-concept exploit available.
Users are advised to upgrade to Cesanta Mongoose version 7.21, which addresses this vulnerability. The patched version is available on the Cesanta Mongoose GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cesanta/mongoose/ | [email protected] | Product |
| https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1 | [email protected] | Patch |
| https://github.com/cesanta/mongoose/releases/tag/7.21 | [email protected] | ProductRelease Notes |
| https://vuldb.com/submit/770063 | [email protected] | ExploitThird Party AdvisoryVDB Entry |
| https://vuldb.com/vuln/354825 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/vuln/354825/cti | [email protected] | Permissions RequiredVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | [email protected] |
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cesanta mongoose | >= 7.0, < 7.21 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Initial Analysis | [email protected] |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 2, 2026 | New CVE Received | [email protected] |