CVE-2026-63626 Details
Description
Mongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MG_ENABLE_TCPIP and MG_ENABLE_IPV6, an unauthenticated adjacent peer can complete the required LCP exchange and send a short Configure-Request with an oversized length, causing ppp_tx_frame() to read beyond recv_queue.buf and write beyond tx.buf. The same length misuse can also expose adjacent heap bytes in a reply or hang the event loop through find_opt(). This issue is fixed in version 7.23.
A heap overflow vulnerability has been identified in Cesanta Mongoose versions prior to 7.23. The issue arises in the function 'ppp_handle_ipv6cp()' within 'src/l2_ppp.c', where the 16-bit length field of the IPv6CP Configure-Request is not properly validated against the actual payload size. This flaw allows an unauthenticated adjacent peer on a PPP or PPPoE link, with 'MG_ENABLE_TCPIP' and 'MG_ENABLE_IPV6' activated, to send a malformed Configure-Request that exploits this oversight. The vulnerability can be exploited to read beyond the intended buffer, write excessive data into the heap, potentially leading to arbitrary code execution on embedded devices, or cause a denial-of-service by hanging the event loop.
Users should upgrade to Cesanta Mongoose version 7.23 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cesanta/mongoose/commit/751f14742dea934bec08a507ab1fecc3673d4903 | [email protected] | Source CodeVendor |
| https://github.com/cesanta/mongoose/releases/tag/7.23 | [email protected] | Release NotesVendor |
| https://github.com/cesanta/mongoose/security/advisories/GHSA-pc66-j6r6-49x9 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Cesanta Mongoose | <= 7.22 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |