Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

Mongoose Security Vulnerabilities | CyStack CVE Database

Vulnerability	Exploitation status	Fix	Published	Severity

`CVE-2026-73253`Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching	Exploitation statusPublic exploit	FixYes	Published08/20/2026	SeverityCritical
`CVE-2026-73255`Mongoose: Path traversal in SSI #include directives enables arbitrary file read	Exploitation statusPublic exploit	FixYes	Published08/20/2026	SeverityMedium
`CVE-2026-73259`Mongoose: Reflected XSS via decoded URI in directory listing render	Exploitation statusPublic exploit	FixYes	Published08/20/2026	SeverityMedium
`CVE-2026-73256`Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE	Exploitation statusNot known exploited	FixYes	Published08/20/2026	SeverityCritical
`CVE-2026-73254`Mongoose: Stored XSS via unescaped filenames in directory listing	Exploitation statusPublic exploit	FixYes	Published08/20/2026	SeverityMedium
`CVE-2026-73258`Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart	Exploitation statusPublic exploit	FixYes	Published08/20/2026	SeverityMedium
`CVE-2026-73251`Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification	Exploitation statusNot known exploited	FixYes	Published08/20/2026	SeverityCritical
`CVE-2026-73257`Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling	Exploitation statusPublic exploit	FixYes	Published08/20/2026	SeverityCritical
`CVE-2026-11404`Cesanta Mongoose Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID Parsing	Exploitation statusNot known exploited	FixYes	Published07/09/2026	SeverityHigh
`CVE-2026-6986`Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verification	Exploitation statusPublic exploit	FixYes	Published04/25/2026	SeverityMedium
`CVE-2026-6985`Cesanta Mongoose TCP Option net_builtin.c handle_opt infinite loop	Exploitation statusPublic exploit	FixYes	Published04/25/2026	SeverityMedium
`CVE-2026-5246`Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization	Exploitation statusPublic exploit	FixYes	Published04/02/2026	SeverityMedium
`CVE-2026-5245`Cesanta Mongoose mDNS Record mongoose.c handle_mdns_record stack-based overflow	Exploitation statusNot known exploited	FixYes	Published04/02/2026	SeverityMedium
`CVE-2026-5244`Cesanta Mongoose TLS 1.3 mongoose.c mg_tls_recv_cert heap-based overflow	Exploitation statusNot known exploited	FixYes	Published04/02/2026	SeverityMedium
`CVE-2026-2968`Cesanta Mongoose Poly1305 Authentication Tag tls_chacha20.c mg_chacha20_poly1305_decrypt signature verification	Exploitation statusPublic exploit	FixNot confirmed	Published02/23/2026	SeverityMedium
`CVE-2026-2967`Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of source	Exploitation statusPublic exploit	FixNot confirmed	Published02/23/2026	SeverityMedium
`CVE-2026-2966`Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values	Exploitation statusPublic exploit	FixNot confirmed	Published02/23/2026	SeverityMedium
`CVE-2025-65502`	Exploitation statusNot known exploited	FixNot confirmed	Published11/24/2025	SeverityMedium
`CVE-2025-51495`	Exploitation statusPublic exploit	FixNot confirmed	Published09/29/2025	SeverityHigh
`CVE-2024-42392`Improper Neutralization of Delimiters in Mongoose Web Server library	Exploitation statusNot known exploited	FixYes	Published11/18/2024	SeverityMedium
`CVE-2024-42391`Use of Out-of-range Pointer Offset in Mongoose Web Server library	Exploitation statusNot known exploited	FixYes	Published11/18/2024	SeverityMedium
`CVE-2024-42390`Use of Out-of-range Pointer Offset in Mongoose Web Server library	Exploitation statusNot known exploited	FixYes	Published11/18/2024	SeverityMedium
`CVE-2024-42389`Use of Out-of-range Pointer Offset in Mongoose Web Server library	Exploitation statusNot known exploited	FixYes	Published11/18/2024	SeverityMedium
`CVE-2024-42388`Use of Out-of-range Pointer Offset in Mongoose Web Server library	Exploitation statusNot known exploited	FixYes	Published11/18/2024	SeverityMedium
`CVE-2024-42387`Use of Out-of-range Pointer Offset in Mongoose Web Server library	Exploitation statusNot known exploited	FixYes	Published11/18/2024	SeverityMedium
`CVE-2024-42386`Use of Out-of-range Pointer Offset in Mongoose Web Server library	Exploitation statusNot known exploited	FixYes	Published11/18/2024	SeverityHigh
`CVE-2024-42385`Improper Neutralization of Delimiters in Mongoose Web Server library	Exploitation statusNot known exploited	FixYes	Published11/18/2024	SeverityMedium
`CVE-2024-42384`Integer Overflow or Wraparound in Mongoose Web Server library	Exploitation statusNot known exploited	FixYes	Published11/18/2024	SeverityHigh
`CVE-2024-42383`Use of Out-of-range Pointer Offset in Mongoose Web Server library	Exploitation statusNot known exploited	FixYes	Published11/18/2024	SeverityMedium
`CVE-2020-25887`	Exploitation statusPublic exploit	FixNot confirmed	Published08/22/2023	SeverityUnknown
`CVE-2023-2905`Cesanta Mongoose MQTT Message Parsing Heap Overflow	Exploitation statusPublic exploit	FixYes	Published08/09/2023	SeverityUnknown
`CVE-2023-34188`	Exploitation statusPublic exploit	FixNot confirmed	Published06/23/2023	SeverityUnknown
`CVE-2022-25299`Arbitrary File Write	Exploitation statusNot confirmed	FixYes	Published02/18/2022	SeverityCritical
`CVE-2021-26529`	Exploitation statusNot confirmed	FixNot confirmed	Published02/08/2021	SeverityUnknown
`CVE-2021-26528`	Exploitation statusNot confirmed	FixNot confirmed	Published02/08/2021	SeverityUnknown
`CVE-2021-26530`	Exploitation statusNot confirmed	FixNot confirmed	Published02/08/2021	SeverityUnknown
`CVE-2020-25756`	Exploitation statusNot known exploited	FixNot confirmed	Published09/18/2020	SeverityUnknown
`CVE-2019-19307`	Exploitation statusNot confirmed	FixNot confirmed	Published11/26/2019	SeverityUnknown
`CVE-2019-13503`	Exploitation statusNot confirmed	FixNot confirmed	Published07/11/2019	SeverityUnknown
`CVE-2019-12951`	Exploitation statusNot confirmed	FixNot confirmed	Published06/24/2019	SeverityUnknown
`CVE-2018-20356`	Exploitation statusNot confirmed	FixNot confirmed	Published06/10/2019	SeverityUnknown
`CVE-2018-20355`	Exploitation statusNot confirmed	FixNot confirmed	Published06/10/2019	SeverityUnknown
`CVE-2018-20354`	Exploitation statusNot confirmed	FixNot confirmed	Published06/10/2019	SeverityUnknown
`CVE-2018-20353`	Exploitation statusNot confirmed	FixNot confirmed	Published06/10/2019	SeverityUnknown
`CVE-2018-19587`	Exploitation statusNot confirmed	FixNot confirmed	Published11/27/2018	SeverityUnknown
`CVE-2018-18764`	Exploitation statusNot confirmed	FixNot confirmed	Published10/28/2018	SeverityUnknown
`CVE-2018-18765`	Exploitation statusNot confirmed	FixNot confirmed	Published10/28/2018	SeverityUnknown
`CVE-2018-10945`	Exploitation statusNot confirmed	FixNot confirmed	Published06/19/2018	SeverityUnknown
`CVE-2017-2895`	Exploitation statusNot confirmed	FixNot confirmed	Published11/07/2017	SeverityHigh
`CVE-2017-2909`	Exploitation statusNot confirmed	FixNot confirmed	Published11/07/2017	SeverityHigh
`CVE-2017-2893`	Exploitation statusNot confirmed	FixNot confirmed	Published11/07/2017	SeverityHigh
`CVE-2017-2891`	Exploitation statusNot confirmed	FixNot confirmed	Published11/07/2017	SeverityCritical
`CVE-2017-2894`	Exploitation statusNot confirmed	FixNot confirmed	Published11/07/2017	SeverityCritical
`CVE-2017-2892`	Exploitation statusNot confirmed	FixNot confirmed	Published11/07/2017	SeverityCritical
`CVE-2017-2922`	Exploitation statusNot confirmed	FixNot confirmed	Published11/07/2017	SeverityCritical
`CVE-2017-2921`	Exploitation statusNot confirmed	FixNot confirmed	Published11/07/2017	SeverityHigh

56 / 56 Results

All vulnerabilities loaded

Security vulnerabilities in Mongoose

Mongoose

How many security vulnerabilities does Mongoose currently have?

Does the latest version of Mongoose have any known vulnerabilities?

Filters

Run an in-depth assessment with complete web risk management