Medium · 4.3 CVE-2025-65502 EUVD-2025-198709GHSA-hp7w-j9mx-8vpj

Null pointer dereference in add_ca_certs() in Cesanta Mongoose before 7.2 allows remote attackers to cause a denial of service via TLS init…

Published Nov 24, 2025 · Updated Nov 24, 2025 · Assigned by mitre

Package: mongoose Package: swupdate Package: swupdate Ecosystem: Debian Ecosystem: Ubuntu

Description

Null pointer dereference in add_ca_certs() in Cesanta Mongoose before 7.2 allows remote attackers to cause a denial of service via TLS initialization where SSL_CTX_get_cert_store() returns NULL.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	swupdate	2025.12+dfsg-1	—
Debian 13	swupdate	No fix yet	—
Debian 12	swupdate	No fix yet	—

Ubuntu