CVE-2026-11404 | High | 7.5 | 2026-07-09 | Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function mg_tls_server_recv_hello(), which uses an attacker-controlled s… |
CVE-2026-6986 | Low | 3.7 | 2026-04-25 | A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This issue affects the function mg_aes_gcm_decrypt of the file /src/tls_aes128.c of… |
CVE-2026-6985 | Medium | 5.3 | 2026-04-25 | A weakness has been identified in Cesanta Mongoose up to 7.20. This vulnerability affects the function handle_opt of the file /src/net_builtin.c of the compone… |
CVE-2026-5246 | Medium | 5.6 | 2026-04-02 | A vulnerability was determined in Cesanta Mongoose up to 7.20. Affected is the function mg_tls_verify_cert_signature of the file mongoose.c of the component P-… |
CVE-2026-5245 | Medium | 5.6 | 2026-04-02 | A vulnerability was found in Cesanta Mongoose up to 7.20. This impacts the function handle_mdns_record of the file mongoose.c of the component mDNS Record Hand… |
CVE-2026-5244 | High | 7.3 | 2026-04-02 | A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mongoose.c of the component TLS 1.3 Handl… |
CVE-2018-25193 | High | 7.5 | 2026-03-06 | Mongoose Web Server 6.9 contains a denial of service vulnerability that allows remote attackers to crash the service by establishing multiple socket connection… |
CVE-2026-2968 | Low | 3.7 | 2026-02-23 | A vulnerability was detected in Cesanta Mongoose up to 7.20. This impacts the function mg_chacha20_poly1305_decrypt of the file /src/tls_chacha20.c of the comp… |
CVE-2026-2967 | Low | 3.7 | 2026-02-23 | A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This affects the function getpeer of the file /src/net_builtin.c of the component TC… |
CVE-2026-2966 | Low | 3.7 | 2026-02-23 | A weakness has been identified in Cesanta Mongoose up to 7.20. The impacted element is the function mg_sendnsreq of the file /src/dns.c of the component DNS Tr… |
CVE-2025-65502 | Medium | 4.3 | 2025-11-24 | Null pointer dereference in add_ca_certs() in Cesanta Mongoose before 7.2 allows remote attackers to cause a denial of service via TLS initialization where SSL… |
CVE-2025-51495 | High | 7.5 | 2025-09-29 | An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17. By sending a specially crafted WebSocket request, an attacker ca… |
CVE-2025-0696 | Medium | 5.3 | 2025-01-27 | A NULL Pointer Dereference vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the component embedding the library b… |
CVE-2025-0695 | Medium | 5.3 | 2025-01-27 | An Allocation of Resources Without Limits or Throttling vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the comp… |
CVE-2024-42392 | Medium | 4.0 | 2024-11-18 | Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an infinite loop bug if the input string contains un… |
CVE-2024-42391 | Medium | 4.3 | 2024-11-18 | Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the applica… |
CVE-2024-42390 | Medium | 4.3 | 2024-11-18 | Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the applica… |
CVE-2024-42389 | Medium | 5.3 | 2024-11-18 | Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the applica… |
CVE-2024-42388 | Medium | 5.3 | 2024-11-18 | Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the applica… |
CVE-2024-42387 | Medium | 5.3 | 2024-11-18 | Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the applica… |
CVE-2024-42386 | High | 8.2 | 2024-11-18 | Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segment… |
CVE-2024-42385 | Medium | 4.0 | 2024-11-18 | Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an out-of-bound memory write if the PEM certificate… |
CVE-2024-42384 | High | 7.5 | 2024-11-18 | Integer Overflow or Wraparound vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentatio… |
CVE-2024-42383 | Medium | 4.2 | 2024-11-18 | Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows to write a NULL byte value beyond the memory space dedicated for t… |
CVE-2024-35386 | High | 7.5 | 2024-05-21 | An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_do_gc function in the mjs.c file. |
CVE-2024-35385 | Medium | 4.3 | 2024-05-21 | An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_mk_ffi_sig function in the mjs.c file. |
CVE-2024-35384 | Medium | 5.5 | 2024-05-21 | An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_array_length function in the mjs.c file. |
CVE-2023-49553 | High | 7.5 | 2024-01-02 | An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_destroy function in the msj.c file. |
CVE-2023-49552 | High | 7.5 | 2024-01-02 | An Out of Bounds Write in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_stringify function in the msj.c file. |
CVE-2023-49551 | High | 7.5 | 2024-01-02 | An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_parse function in the msj.c file. |
CVE-2023-49550 | High | 7.5 | 2024-01-02 | An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs+0x4ec508 component. |
CVE-2023-49549 | High | 7.5 | 2024-01-02 | An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_getretvalpos function in the msj.c file. |
CVE-2023-50044 | Critical | 9.8 | 2023-12-20 | Cesanta MJS 2.20.0 has a getprop_builtin_foreign out-of-bounds read if a Built-in API name occurs in a substring of an input string. |
CVE-2023-43338 | Critical | 9.8 | 2023-09-23 | Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the function mjs_get_ptr(). This vulnerability allows attackers to… |
CVE-2020-25887 | High | 8.8 | 2023-08-22 | Buffer overflow in mg_resolve_from_hosts_file in Mongoose 6.18, when reading from a crafted hosts file. |
CVE-2023-2905 | High | 8.8 | 2023-08-09 | Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web serv… |
CVE-2023-34188 | High | 7.5 | 2023-06-23 | The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker c… |
CVE-2023-30088 | Medium | 5.5 | 2023-05-09 | An issue found in Cesanta MJS v.1.26 allows a local attacker to cause a denial of service via the mjs_execute function in mjs.c. |
CVE-2023-30087 | Medium | 5.5 | 2023-05-09 | Buffer Overflow vulnerability found in Cesanta MJS v.1.26 allows a local attacker to cause a denial of service via the mjs_mk_string function in mjs.c. |
CVE-2023-29570 | Medium | 5.5 | 2023-04-24 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_ffi_cb_free at src/mjs_ffi.c. This vulnerability can lead to a Denial of Service (Do… |
CVE-2023-29569 | Medium | 5.5 | 2023-04-14 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via ffi_cb_impl_wpwwwww at src/mjs_ffi.c. This vulnerability can lead to a Denial of Service… |
CVE-2023-29571 | Medium | 5.5 | 2023-04-12 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via gc_sweep at src/mjs_gc.c. This vulnerability can lead to a Denial of Service (DoS). |
CVE-2021-36535 | Medium | 5.5 | 2023-02-03 | Buffer Overflow vulnerability in Cesanta mJS 1.26 allows remote attackers to cause a denial of service via crafted .js file to mjs_set_errorf. |
CVE-2021-33449 | Medium | 5.5 | 2022-07-26 | An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_bcode_part_get_by_offs… |
CVE-2021-33448 | Medium | 5.5 | 2022-07-26 | An issue was discovered in mjs(mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is stack buffer overflow at 0x7fffe9049390. |
CVE-2021-33447 | Medium | 5.5 | 2022-07-26 | An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_print() in mjs.c. |
CVE-2021-33446 | Medium | 5.5 | 2022-07-26 | An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_next() in mjs.c. |
CVE-2021-33445 | Medium | 5.5 | 2022-07-26 | An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_string_char_code_at()… |
CVE-2021-33444 | Medium | 5.5 | 2022-07-26 | An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in getprop_builtin_foreign()… |
CVE-2021-33443 | Medium | 5.5 | 2022-07-26 | An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is stack buffer overflow in mjs_execute() in mjs.c. |
CVE-2021-33442 | Medium | 5.5 | 2022-07-26 | An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in json_printf() in mjs.c. |
CVE-2021-33441 | Medium | 5.5 | 2022-07-26 | An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in exec_expr() in mjs.c. |
CVE-2021-33440 | Medium | 5.5 | 2022-07-26 | An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is NULL pointer dereference in mjs_bcode_commit() in mjs… |
CVE-2021-33439 | Medium | 5.5 | 2022-07-26 | An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is Integer overflow in gc_compact_strings() in mjs.c. |
CVE-2021-33438 | Medium | 5.5 | 2022-07-26 | An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There is stack buffer overflow in json_parse_array() in mjs.c. |
CVE-2021-33437 | Medium | 5.5 | 2022-07-26 | An issue was discovered in mjs (mJS: Restricted JavaScript engine), ES6 (JavaScript version 6). There are memory leaks in frozen_cb() in mjs.c. |
CVE-2021-27425 | High | 7.3 | 2022-05-03 | Cesanta Software Mongoose-OS v2.17.0 is vulnerable to integer wrap-around in function mm_malloc. This improper memory assignment can lead to arbitrary memory a… |
CVE-2022-25299 | Critical | 9.8 | 2022-02-18 | This affects the package cesanta/mongoose before 7.6. The unsafe handling of file names during upload using mg_http_upload() method may enable attackers to wri… |
CVE-2021-46556 | Medium | 5.5 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_bcode_insert_offset at src/mjs_bcode.c. This vulnerability can lead to a Denial of S… |
CVE-2021-46554 | Medium | 5.5 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_json_stringify at src/mjs_json.c. This vulnerability can lead to a Denial of Service… |
CVE-2021-46553 | Medium | 5.5 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_set_internal at src/mjs_object.c. This vulnerability can lead to a Denial of Service… |
CVE-2021-46550 | Medium | 5.5 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via free_json_frame at src/mjs_json.c. This vulnerability can lead to a Denial of Service (D… |
CVE-2021-46549 | Medium | 5.5 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via parse_cval_type at src/mjs_ffi.c. This vulnerability can lead to a Denial of Service (Do… |
CVE-2021-46548 | Medium | 5.5 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via add_lineno_map_item at src/mjs_bcode.c. This vulnerability can lead to a Denial of Servi… |
CVE-2021-46547 | Medium | 5.5 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/local/bin/mjs+0x2c17e. This vulnerability can lead to a Denial of Service (DoS). |
CVE-2021-46546 | Medium | 5.5 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_next at src/mjs_object.c. This vulnerability can lead to a Denial of Service (DoS). |
CVE-2021-46545 | Medium | 5.5 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /lib/x86_64-linux-gnu/libc.so.6+0x4b44b. This vulnerability can lead to a Denial of Serv… |
CVE-2021-46544 | Medium | 5.5 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/lib/x86_64-linux-gnu/libasan.so.4+0x59e19. This vulnerability can lead to a Denial… |
CVE-2021-46543 | Medium | 5.5 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /lib/x86_64-linux-gnu/libc.so.6+0x18e810. This vulnerability can lead to a Denial of Ser… |
CVE-2021-46542 | Medium | 5.5 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_print at src/mjs_builtin.c. This vulnerability can lead to a Denial of Service (DoS). |
CVE-2021-46541 | Medium | 5.5 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/local/bin/mjs+0x2c6ae. This vulnerability can lead to a Denial of Service (DoS). |
CVE-2021-46540 | Medium | 5.5 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_get_mjs at src/mjs_builtin.c. This vulnerability can lead to a Denial of Service (Do… |
CVE-2021-46539 | Medium | 5.5 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /lib/x86_64-linux-gnu/libc.so.6+0x45a1f. This vulnerability can lead to a Denial of Serv… |
CVE-2021-46538 | Medium | 5.5 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via gc_compact_strings at src/mjs_gc.c. This vulnerability can lead to a Denial of Service (… |
CVE-2021-46537 | Medium | 5.5 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/local/bin/mjs+0x9a30e. This vulnerability can lead to a Denial of Service (DoS). |
CVE-2021-46535 | Medium | 5.5 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/local/bin/mjs+0xe533e. This vulnerability can lead to a Denial of Service (DoS). |
CVE-2021-46534 | Medium | 5.5 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via getprop_builtin_foreign at src/mjs_exec.c. This vulnerability can lead to a Denial of Se… |
CVE-2021-46532 | Medium | 5.5 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via exec_expr at src/mjs_exec.c. This vulnerability can lead to a Denial of Service (DoS). |
CVE-2021-46531 | Medium | 5.5 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/local/bin/mjs+0x8d28e. This vulnerability can lead to a Denial of Service (DoS). |
CVE-2021-46530 | Medium | 5.5 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_execute at src/mjs_exec.c. This vulnerability can lead to a Denial of Service (DoS). |
CVE-2021-46529 | Medium | 5.5 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/local/bin/mjs+0x8814e. This vulnerability can lead to a Denial of Service (DoS). |
CVE-2021-46528 | Medium | 5.5 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via /usr/local/bin/mjs+0x5361e. This vulnerability can lead to a Denial of Service (DoS). |
CVE-2021-46527 | High | 7.8 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via mjs_get_cstring at src/mjs_string.c. |
CVE-2021-46526 | High | 7.8 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a global buffer overflow via snquote at src/mjs_json.c. |
CVE-2021-46525 | High | 7.8 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a heap-use-after-free via mjs_apply at src/mjs_exec.c. |
CVE-2021-46524 | High | 7.8 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via snquote at mjs/src/mjs_json.c. |
CVE-2021-46523 | High | 7.8 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via to_json_or_debug at mjs/src/mjs_json.c. |
CVE-2021-46522 | High | 7.8 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via /usr/lib/x86_64-linux-gnu/libasan.so.4+0xaff53. |
CVE-2021-46521 | High | 7.8 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a global buffer overflow via c_vsnprintf at mjs/src/common/str_util.c. |
CVE-2021-46520 | High | 7.8 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via mjs_jprintf at src/mjs_util.c. |
CVE-2021-46519 | High | 7.8 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via mjs_array_length at src/mjs_array.c. |
CVE-2021-46518 | High | 7.8 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a heap buffer overflow via mjs_disown at src/mjs_core.c. |
CVE-2021-46517 | Medium | 5.5 | 2022-01-27 | There is an Assertion `mjs_stack_size(&mjs->scopes) > 0' failed at src/mjs_exec.c in Cesanta MJS v2.20.0. |
CVE-2021-46516 | Medium | 5.5 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_stack_size at mjs/src/mjs_core.c. This vulnerability can lead to a Denial of Service… |
CVE-2021-46515 | Medium | 5.5 | 2022-01-27 | There is an Assertion `mjs_stack_size(&mjs->scopes) >= scopes_len' failed at src/mjs_exec.c in Cesanta MJS v2.20.0. |
CVE-2021-46514 | Medium | 5.5 | 2022-01-27 | There is an Assertion 'ppos != NULL && mjs_is_number(*ppos)' failed at src/mjs_core.c in Cesanta MJS v2.20.0. |
CVE-2021-46513 | High | 7.8 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a global buffer overflow via mjs_mk_string at mjs/src/mjs_string.c. |
CVE-2021-46512 | Medium | 5.5 | 2022-01-27 | Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_apply at src/mjs_exec.c. This vulnerability can lead to a Denial of Service (DoS). |
CVE-2021-46511 | Medium | 5.5 | 2022-01-27 | There is an Assertion `m->len >= sizeof(v)' failed at src/mjs_core.c in Cesanta MJS v2.20.0. |
CVE-2021-46510 | Medium | 5.5 | 2022-01-27 | There is an Assertion `s < mjs->owned_strings.buf + mjs->owned_strings.len' failed at src/mjs_gc.c in Cesanta MJS v2.20.0. |