PT-2026-35157 · Cesanta · Mongoose

Dwbruijn · Published 2026-04-25 · Updated 2026-04-25 · CVE-2026-6986

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cesanta Mongoose versions prior to 7.21

Description An issue exists in the GCM Authentication Tag Handler within the mg aes gcm decrypt() function of the /src/tls aes128.c file. This flaw leads to improper verification of cryptographic signatures, which can be exploited remotely. The attack is characterized by high complexity and is considered difficult to execute.

Recommendations Upgrade to version 7.21.

Exploit

Fix

Improper Verification of Cryptographic Signature

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-347

CWE-345

Related Identifiers

CVE-2026-6986

Affected Products

Mongoose

References · 10

• 🔥 https://github.com/dwBruijn/CVEs/blob/main/Mongoose/AESGCM.md · Exploit
• https://github.com/cesanta/mongoose/releases/tag/7.21 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-6986 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-6986 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-6986 · Vendor Advisory
• https://vuldb.com/submit/796231 · Note
• https://vuldb.com/vuln/359529 · Note
• https://vuldb.com/vuln/359529/cti · Note
• https://twitter.com/CVEnew/status/2048099260663574871 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2048097514717323311 · Twitter Post