CVE-2026-11404

Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function mg_tls_server_recv_hello(), which uses an attacker-controlled session_id_len byte from a TLS ClientHello as a buffer index without validating it against the length of received data. A remote, unauthenticated attacker can send a single crafted ClientHello with an oversized session id length to read past the receive buffer, crashing any HTTPS, MQTTS, or WSS service built on MG_TLS_BUILTIN.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/cesanta/mongoose
https://github.com/cesanta/mongoose/releases/tag/7.22

Configurations

No configuration.

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Cesanta Mongoose anterior a la versión 7.22 contiene una lectura fuera de límites en la función de servidor TLS integrada mg_tls_server_recv_hello(), que utiliza un byte ’session_id_len’ controlado por el atacante de un TLS ClientHello como un índice de búfer sin validarlo contra la longitud de los datos recibidos. Un atacante remoto y no autenticado puede enviar un único ClientHello manipulado con una longitud de ID de sesión excesiva para leer más allá del búfer de recepción, provocando la caída de cualquier servicio HTTPS, MQTTS o WSS construido sobre MG_TLS_BUILTIN.

Information

Published : 2026-07-09 16:16

Updated : 2026-10-25 17:10

NVD link : CVE-2026-11404

Mitre link : CVE-2026-11404

CVE.ORG link : CVE-2026-11404

JSON object : View

Products Affected

No product.

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2026-11404", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-11404", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T16:09:47.106576Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Cesanta", "product": "Mongoose", "versions": [{"status": "affected", "version": "0", "lessThan": "7.22", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-09T16:16:34.640", "references": [{"url": "https://github.com/cesanta/mongoose", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/cesanta/mongoose/releases/tag/7.22", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function mg_tls_server_recv_hello(), which uses an attacker-controlled session_id_len byte from a TLS ClientHello as a buffer index without validating it against the length of received data. A remote, unauthenticated attacker can send a single crafted ClientHello with an oversized session id length to read past the receive buffer, crashing any HTTPS, MQTTS, or WSS service built on MG_TLS_BUILTIN."}, {"lang": "es", "value": "Cesanta Mongoose anterior a la versi\u00f3n 7.22 contiene una lectura fuera de l\u00edmites en la funci\u00f3n de servidor TLS integrada mg_tls_server_recv_hello(), que utiliza un byte \u2019session_id_len\u2019 controlado por el atacante de un TLS ClientHello como un \u00edndice de b\u00fafer sin validarlo contra la longitud de los datos recibidos. Un atacante remoto y no autenticado puede enviar un \u00fanico ClientHello manipulado con una longitud de ID de sesi\u00f3n excesiva para leer m\u00e1s all\u00e1 del b\u00fafer de recepci\u00f3n, provocando la ca\u00edda de cualquier servicio HTTPS, MQTTS o WSS construido sobre MG_TLS_BUILTIN."}], "lastModified": "2026-10-25T17:10:00.197", "sourceIdentifier": "disclosure@vulncheck.com"}