PT-2026-29715 · Cesanta · Cesanta Mongoose

The_Evilsocket · Published 2026-04-02 · Updated 2026-04-30 · CVE-2026-5245

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cesanta Mongoose versions up to 7.20

Description A flaw exists in Cesanta Mongoose up to version 7.20 within the mDNS Record Handler component, specifically in the handle mdns record function of the mongoose.c file. Manipulation of the buf argument can lead to a stack-based buffer overflow. Remote exploitation is possible, but requires a high degree of complexity and is considered difficult. The exploit has been publicly disclosed.

Recommendations Upgrade to version 7.21 or later.

Fix

Buffer Overflow

Stack Overflow

Weakness Enumeration

CWE-119

CWE-121

Related Identifiers

CVE-2026-5245

JLSEC-2026-370

Affected Products

Cesanta Mongoose

References · 14

• https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1 · Patch
• https://github.com/cesanta/mongoose/releases/tag/7.21 · Patch
• https://osv.dev/vulnerability/JLSEC-2026-370 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5245 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-5245 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-5245 · Vendor Advisory
• https://github.com/cesanta/mongoose · Note
• https://vuldb.com/vuln/354826/cti · Note
• https://evilsocket.net/2026/04/02/Mongoose-Preauth-Remote-Code-Execution-and-mTLS-Bypass · Reddit Post
• https://twitter.com/CVEnew/status/2039647677965848612 · Twitter Post
• https://twitter.com/evilsocket/status/2039656380919886282 · Twitter Post
• https://vuldb.com/vuln/354826 · Note
• https://github.com/advisories/GHSA-2rqj-7x75-2684 · Note
• https://vuldb.com/submit/770103 · Note