#VU111839 Input validation error in Mongoose - CVE-2023-34188
Published: February 28, 2025 / Updated: June 23, 2025
Vulnerability identifier: #VU111839
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2023-34188
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Mongoose
Mongoose
Software vendor:
Cesanta Software Ltd.
Cesanta Software Ltd.
Description
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests.
Remediation
Install update from vendor's website.
External links
- https://blog.narfindustries.com/blog/narf-discovers-critical-vulnerabilities-in-cesanta-mongoose-http-server
- https://github.com/cesanta/mongoose/commit/4663090a8fb036146dfe77718cff612b0101cb0f
- https://github.com/cesanta/mongoose/compare/7.9...7.10
- https://github.com/cesanta/mongoose/pull/2197
- https://security.netapp.com/advisory/ntap-20250228-0001/