Cesanta vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-73261 Mongoose is an embedded web server and network library.High 7.5 · Oct 14, 2026
• CVE-2026-73260 Mongoose is an embedded web server and network library.High 7.5 · Oct 14, 2026
• CVE-2026-73252 Mongoose is an embedded web server and network library.High 7.5 · Oct 14, 2026
• CVE-2026-63626 Mongoose is an embedded web server and network library.High 8.8 · Oct 14, 2026
• CVE-2026-73257 Mongoose is an embedded web server and network library.Critical 9.1 · Aug 20, 2026
• CVE-2026-73256 Mongoose is an embedded web server and network library.Critical 9.1 · Aug 20, 2026
• CVE-2026-73253 Mongoose is an embedded web server and network library.Critical 9.1 · Aug 20, 2026
• CVE-2026-73251 Mongoose is an embedded web server and network library.Critical 9.3 · Aug 20, 2026
• CVE-2026-11404 Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function mg_tls_server_recv_hello(), which uses an attacker-controlled seHigh 8.7 · Jul 9, 2026
• CVE-2018-25193 Mongoose Web Server 6.9 contains a denial of service vulnerability that allows remote attackers to crash the service by establishing multiple socket connectionsHigh 8.7 · Mar 6, 2026
• CVE-2025-51495 An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17.High 7.5 · Sep 29, 2025
• CVE-2024-42386 Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentaHigh 8.2 · Nov 18, 2024
• CVE-2024-42384 Integer Overflow or Wraparound vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentationHigh 7.5 · Nov 18, 2024
• CVE-2024-35492 Cesanta Mongoose commit b316989 was discovered to contain a NULL pointer dereference via the scpy function at src/fmt.c.High 7.5 · May 29, 2024
• CVE-2024-35386 An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_do_gc function in the mjs.c file.High 7.5 · May 21, 2024
• CVE-2023-49553 An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_destroy function in the msj.c file.High 7.5 · Jan 2, 2024
• CVE-2023-49552 An Out of Bounds Write in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_stringify function in the msj.c file.High 7.5 · Jan 2, 2024
• CVE-2023-49551 An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_parse function in the msj.c file.High 7.5 · Jan 2, 2024
• CVE-2023-49550 An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs+0x4ec508 component.High 7.5 · Jan 2, 2024
• CVE-2023-49549 An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_getretvalpos function in the msj.c file.High 7.5 · Jan 2, 2024
• CVE-2023-50044 Cesanta MJS 2.20.0 has a getprop_builtin_foreign out-of-bounds read if a Built-in API name occurs in a substring of an input string.Critical 9.8 · Dec 20, 2023
• CVE-2023-43338 Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the function mjs_get_ptr().Critical 9.8 · Sep 22, 2023
• CVE-2020-25887 Buffer overflow in mg_resolve_from_hosts_file in Mongoose 6.18, when reading from a crafted hosts file.High 8.8 · Aug 22, 2023
• CVE-2023-2905 Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web serveHigh 8.8 · Aug 9, 2023
• CVE-2023-34188 The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers.High 7.5 · Jun 23, 2023