mongoose
- Software type
- Web server
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/23/2026, mongoose recorded 13 security vulnerabilities in the last 90 days, of which 8 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of mongoose and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-63626Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6)CVE-2026-73261Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connectionCVE-2026-73260Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parserCVE-2026-73252Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAXCVE-2026-101003Cesanta Mongoose MQTT Broker main.c fn stack-based overflow| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-63626Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6) | Exploitation statusNot exploited | FixYes |
| SeverityHigh |
CVE-2026-73261Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connection | Exploitation statusNot confirmed | FixYes | Published10/14/2026 | SeverityHigh |
|---|
CVE-2026-73260Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser | Exploitation statusActively exploited | FixYes | Published10/14/2026 | SeverityHigh |
|---|
CVE-2026-73252Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAX | Exploitation statusActively exploited | FixYes | Published10/14/2026 | SeverityHigh |
|---|
CVE-2026-101003Cesanta Mongoose MQTT Broker main.c fn stack-based overflow | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityMedium |
|---|
CVE-2026-73253Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching | Exploitation statusActively exploited | FixYes | Published08/20/2026 | SeverityCritical |
|---|
CVE-2026-73255Mongoose: Path traversal in SSI #include directives enables arbitrary file read | Exploitation statusActively exploited | FixYes | Published08/20/2026 | SeverityMedium |
|---|
CVE-2026-73259Mongoose: Reflected XSS via decoded URI in directory listing render | Exploitation statusActively exploited | FixYes | Published08/20/2026 | SeverityMedium |
|---|
CVE-2026-73256Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE | Exploitation statusNot exploited | FixYes | Published08/20/2026 | SeverityCritical |
|---|
CVE-2026-73254Mongoose: Stored XSS via unescaped filenames in directory listing | Exploitation statusActively exploited | FixYes | Published08/20/2026 | SeverityMedium |
|---|
62 Results | Page 1 of 7