SB20260812411 - Multiple vulnerabilities in Mongoose

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260812411

SB20260812411 - Multiple vulnerabilities in Mongoose

Published: August 12, 2026

Security Bulletin ID SB20260812411
CSH Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 20% Medium 80%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Improper Certificate Validation (CVE-ID: CVE-2026-73251)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass TLS server authentication and perform a man-in-the-middle attack.

The vulnerability exists due to improper certificate validation in mg_tls_recv_cert() in src/tls_builtin.c when verifying a server certificate chain against a multi-certificate PEM CA bundle. A remote attacker can present a forged certificate with a matching hostname and an issuer common name matching a root in the bundle to bypass TLS server authentication and perform a man-in-the-middle attack.

Only built-in-TLS client configurations using a CA bundle containing more than one certificate are affected.


2) Out-of-bounds read (CVE-ID: CVE-2026-73252)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in mg_tls_recv_record() and mg_tls_drop_message() when processing a crafted TLS 1.3 record in the built-in TLS stack. A remote attacker can send a specially crafted encrypted record with a 16-byte decrypted size to cause a denial of service.

The issue is reachable before authentication during the TLS 1.3 handshake in configurations using MG_TLS_BUILTIN.


3) Out-of-bounds read (CVE-ID: CVE-2026-73260)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the built-in TLS X.509 DER parser when parsing a crafted X.509 certificate during the TLS handshake. A remote attacker can present a specially crafted certificate to cause a denial of service.

Only applications built with the built-in TLS stack are vulnerable, and exploitation occurs before authentication completes.


4) Heap-based buffer overflow (CVE-ID: CVE-2026-63626)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code, disclose sensitive information, or cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in ppp_handle_ipv6cp() in src/l2_ppp.c when processing crafted IPv6CP frames on a PPP or PPPoE link. A remote attacker can send a specially crafted IPv6CP Configure-Request with an attacker-controlled length field to execute arbitrary code, disclose sensitive information, or cause a denial of service.

Only configurations with MG_ENABLE_TCPIP=1 and MG_ENABLE_IPV6=1 using the PPP or PPPoE link layer are affected. A prior LCP exchange is required to satisfy the IPv6CP dispatch precondition.


5) Out-of-bounds read (CVE-ID: CVE-2026-73261)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in handle_opt() in src/net_builtin.c when processing crafted TCP options during connection establishment. A remote attacker can send a specially crafted TCP SYN or SYN-ACK packet to cause a denial of service.

Only configurations with MG_ENABLE_TCPIP=1 and TCP usage are vulnerable. The issue can affect both inbound server connections and outbound client connections to an attacker-controlled peer. The connection remains established at the TCP level while application data may be silently reduced or blocked.


Remediation

Install update from vendor's website.

References