CRITICAL🇵🇱 Wersja polska

CVE-2021-26530

CVSS 9.1v3.1pub. 2021-02-08upd. 2024-11-21

The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 (compiled with OpenSSL support) is vulnerable to remote OOB write attack via connection request after exhausting memory pool.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

  • Cesanta Mongoose

    APP
    Cesanta
    7.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2022-25299CRITICAL9.8PL ✓same product

Zapis plików poza docelowym folderem w Cesanta Mongoose (mg_http_upload)

CVE-2021-26528CRITICAL9.1PL ✓same product

Zapis poza granicami pamięci (OOB write) w Cesanta Mongoose HTTP server 7.0

CVE-2021-26529CRITICAL9.1PL ✓same product

Zapis poza granicami bufora (OOB write) w Cesanta Mongoose HTTPS — mg_tls_init

CVE-2020-25756CRITICAL9.8PL ✓same product

Buffer overflow w Cesanta Mongoose — mg_get_http_header

CVE-2019-19307CRITICAL9.8PL ✓same product

Integer overflow w Cesanta Mongoose — błąd parsowania pakietów MQTT