Skip to content
OpenAdvisories
High · 7.5 Public exploit CVE-2025-51495 EUVD-2025-31586GHSA-83rc-g55p-8xj2

An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17. By sending a specially crafted WebSocket req…

Published Sep 29, 2025 · Updated Oct 1, 2025 · Assigned by mitre

Package: swupdate Package: swupdate Ecosystem: Debian Ecosystem: Ubuntu

Description

An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17. By sending a specially crafted WebSocket request, an attacker can cause the application to crash. If downstream vendors integrate this component improperly, the issue may lead to a buffer overflow.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 swupdate 2025.12+dfsg-1 —
Debian 13 swupdate No fix yet —
Debian 12 swupdate No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 25.10 swupdate No fix yet —
Ubuntu 24.04 LTS swupdate No fix yet —
Ubuntu 22.04 LTS swupdate No fix yet —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 1

References