PT-2026-21494 · Cesanta · Cesanta Mongoose

Dwbruijn · Published 2026-02-23 · Updated 2026-04-30 · CVE-2026-2967

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Cesanta Mongoose versions prior to 7.21

Description A security issue exists in Cesanta Mongoose. The getpeer function within the TCP Sequence Number Handler component, located in /src/net builtin.c, does not properly verify the source of a communication channel. This allows for remote attacks with high complexity and difficult exploitability. The exploit has been publicly disclosed.

Recommendations Update to version 7.21 or later. As a temporary workaround, consider restricting access to the getpeer function until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-940

Related Identifiers

CVE-2026-2967

JLSEC-2026-367

Affected Products

Cesanta Mongoose

References · 16

• 🔥 https://github.com/dwBruijn/CVEs/blob/main/Mongoose/tcp_rst.md · Exploit
• 🔥 https://github.com/dwBruijn/CVEs/blob/main/Mongoose/tcp_rst.md#poc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-2967 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-2967 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2967 · Vendor Advisory
• https://osv.dev/vulnerability/JLSEC-2026-367 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-2967 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-2967 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-2967 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-2967 · Vendor Advisory
• https://t.me/CVEtracker/45472 · Telegram Post
• https://github.com/advisories/GHSA-c6h3-vh8h-r8mj · Note
• https://vuldb.com/?submit.755450 · Note
• https://twitter.com/CVEnew/status/2025809027746443521 · Twitter Post
• https://vuldb.com/?id.347334 · Note