CRITICAL🇵🇱 Wersja polska

CVE-2021-26529

CVSS 9.1v3.1pub. 2021-02-08upd. 2024-11-21

The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable to remote OOB write attack via connection request after exhausting memory pool.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

  • Cesanta Mongoose

    APP
    Cesanta
    7.06.7 – 6.18
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2022-25299CRITICAL9.8PL ✓same product

Zapis plików poza docelowym folderem w Cesanta Mongoose (mg_http_upload)

CVE-2021-26528CRITICAL9.1PL ✓same product

Zapis poza granicami pamięci (OOB write) w Cesanta Mongoose HTTP server 7.0

CVE-2021-26530CRITICAL9.1PL ✓same product

Zapis poza granicami pamięci (OOB write) w serwerze HTTPS Cesanta Mongoose 7.0

CVE-2020-25756CRITICAL9.8PL ✓same product

Buffer overflow w Cesanta Mongoose — mg_get_http_header

CVE-2019-19307CRITICAL9.8PL ✓same product

Integer overflow w Cesanta Mongoose — błąd parsowania pakietów MQTT