Vendor
Cesanta Software
47 known vulnerabilities.
8 results · Clear filters · Feed
-
Critical 9.1
Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching
Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mg_tls_verify_cert_san()…
-
Critical 9.1
Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE
Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http_cb() function in s…
-
Critical 9.3
Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification
Mongoose is an embedded web server and network library. Prior to 7.23, a network attacker can impersonate a TLS server to a Mongoose client configured with a multi-certificate CA bundle. In src/tls_builtin.c, the mg_tls_init() function stores the bundle in tl…
-
Critical 9.1
Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling
Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_http_parse() an…
-
Critical 9.8
An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8. An ordina…
-
Critical 9.8CVE-2017-2894 EPSS 31%
An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose …
-
Critical 9.8
An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose …
-
Critical 9.8
An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8.…