PT-2026-21490 · Cesanta · Cesanta Mongoose

Dwbruijn · Published 2026-02-23 · Updated 2026-04-30 · CVE-2026-2966

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cesanta Mongoose versions up to 7.20

Description A weakness exists in Cesanta Mongoose related to insufficiently random values generated by the mg sendnsreq function within the DNS Transaction ID Handler component, located in the file /src/dns.c. Manipulation of the random argument can trigger this issue. The attack can be launched remotely and is considered difficult to exploit, but the exploit has been publicly released. The vendor was contacted regarding this disclosure but did not respond.

Recommendations Versions prior to 7.20 should be updated. As a temporary workaround, consider restricting access to the DNS Transaction ID Handler component to minimize the risk of exploitation.

Exploit

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-310

CWE-330

Related Identifiers

CVE-2026-2966

JLSEC-2026-366

Affected Products

Cesanta Mongoose

References · 18

• 🔥 https://github.com/dwBruijn/CVEs/blob/main/Mongoose/mg_sendnsreq.md · Exploit
• 🔥 https://github.com/dwBruijn/CVEs/blob/main/Mongoose/mg_sendnsreq.md#poc · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-2966 · Vendor Advisory
• https://osv.dev/vulnerability/JLSEC-2026-366 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-2966 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-2966 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2966 · Security Note
• https://ubuntu.com/security/CVE-2026-2966 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-2966 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-2966 · Security Note
• https://vuldb.com/?submit.755304 · Note
• https://twitter.com/VulmonFeeds/status/2025774868050899300 · Twitter Post
• https://vuldb.com/?ctiid.347333 · Note
• https://twitter.com/CVEnew/status/2025809028723744928 · Twitter Post
• https://github.com/advisories/GHSA-m5mm-h952-fxjj · Note