CVE-2026-6986 Details
Description
A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This issue affects the function mg_aes_gcm_decrypt of the file /src/tls_aes128.c of the component GCM Authentication Tag Handler. Such manipulation leads to improper verification of cryptographic signature. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 7.21 is capable of addressing this issue. It is advisable to upgrade the affected component. VulDB has contacted the vendor early and they confirmed quickly, that this issue got fixed already.
A vulnerability exists in Cesanta Mongoose versions prior to 7.21, specifically in the GCM Authentication Tag Handler within the `mg_aes_gcm_decrypt` function of the file `/src/tls_aes128.c`. This vulnerability arises because the function fails to verify the GCM authentication tag during decryption, thereby bypassing the authentication guarantees of the AES-GCM cipher. The issue allows a remote attacker to manipulate encrypted data in transit, exploiting the lack of authentication to perform bit-flipping attacks on TLS records. The vulnerability has been publicly disclosed and is considered difficult to exploit, but an exploit is available.
Upgrading to Cesanta Mongoose version 7.21 addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cesanta/mongoose/releases/tag/7.21 | [email protected] | Release Notes |
| https://github.com/dwBruijn/CVEs/blob/main/Mongoose/AESGCM.md | [email protected] | ExploitThird Party Advisory |
| https://vuldb.com/submit/796231 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/vuln/359529 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/vuln/359529/cti | [email protected] | Permissions RequiredVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
| CWE-347 | Improper Verification of Cryptographic Signature | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cesanta mongoose | >= 7.0, < 7.21 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Initial Analysis | [email protected] |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 25, 2026 | New CVE Received | [email protected] |