Input validation error in Mongoose - CVE-2024-42392
Published: November 19, 2024 / Updated: June 23, 2025
Vulnerability identifier: #VU111820
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-42392
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an infinite loop bug if the input string contains unexpected characters.
Affected software
Mongoose
How to mitigate CVE-2024-42392
Install update from vendor's website.
Mongoose - update to 7.15