PT-2026-21495 · Cesanta · Cesanta Mongoose

Dwbruijn · Published 2026-02-23 · Updated 2026-02-23 · CVE-2026-2968

Positive Technologies · (AI Summary)

CVSS v3.1

3.7

Low

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cesanta Mongoose versions prior to 7.21

Description A security issue exists in Cesanta Mongoose related to improper verification of cryptographic signatures. The issue resides in the mg chacha20 poly1305 decrypt function within the /src/tls chacha20.c file, specifically within the Poly1305 Authentication Tag Handler component. The attack can be initiated remotely and is considered to have high complexity, with difficult exploitability. The exploit is publicly available.

Recommendations Update to version 7.21 or later. As a temporary workaround, consider restricting the use of the mg chacha20 poly1305 decrypt function until a patch is available.

Exploit

Fix

Improper Verification of Cryptographic Signature

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-347

CWE-345

Related Identifiers

CVE-2026-2968

Affected Products

Cesanta Mongoose

References · 12

• 🔥 https://github.com/dwBruijn/CVEs/blob/main/Mongoose/ChaCha20Poly1305.md · Exploit
• 🔥 https://github.com/dwBruijn/CVEs/blob/main/Mongoose/ChaCha20Poly1305.md#poc · Exploit
• https://osv.dev/vulnerability/CVE-2026-2968 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-2968 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-2968 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-2968 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-2968 · Security Note
• https://vuldb.com/?submit.757091 · Note
• https://vuldb.com/?ctiid.347335 · Note
• https://vuldb.com/?id.347335 · Note
• https://t.me/CVEtracker/45473 · Telegram Post
• https://twitter.com/CVEnew/status/2025809025615659205 · Twitter Post