CVE-2025-51495

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-51495", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-10-01T15:21:21.511Z", "dateReserved": "2025-06-16T00:00:00.000Z", "datePublished": "2025-09-29T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-10-01T15:21:21.511Z"}, "descriptions": [{"lang": "en", "value": "An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17. By sending a specially crafted WebSocket request, an attacker can cause the application to crash. If downstream vendors integrate this component improperly, the issue may lead to a buffer overflow."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/cesanta/mongoose"}, {"url": "https://github.com/cesanta/mongoose/pull/3131"}, {"url": "https://github.com/cainiao159357/CVE-2025-51495"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-190", "lang": "en", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-09-29T19:55:19.399329Z", "id": "CVE-2025-51495", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-30T17:26:32.780Z"}}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-51495", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-29T19:55:19.399329Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-29T19:55:40.383Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/cesanta/mongoose"}, {"url": "https://github.com/cesanta/mongoose/pull/3131"}, {"url": "https://github.com/cainiao159357/CVE-2025-51495"}], "descriptions": [{"lang": "en", "value": "An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17. By sending a specially crafted WebSocket request, an attacker can cause the application to crash. If downstream vendors integrate this component improperly, the issue may lead to a buffer overflow."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-10-01T15:21:21.511Z"}}}, "cveMetadata": {"cveId": "CVE-2025-51495", "state": "PUBLISHED", "dateUpdated": "2025-10-01T15:21:21.511Z", "dateReserved": "2025-06-16T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2025-09-29T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cesanta:mongoose:*:*:*:*:*:*:*:*", "matchCriteriaId": "1D589ED4-2625-4BC2-9A2E-136A1B8F6E38", "versionEndIncluding": "7.17", "versionStartIncluding": "7.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17. By sending a specially crafted WebSocket request, an attacker can cause the application to crash. If downstream vendors integrate this component improperly, the issue may lead to a buffer overflow."}, {"lang": "es", "value": "Existe una vulnerabilidad de desbordamiento de entero en el componente WebSocket de Mongoose 7.5 hasta 7.17. Al enviar una solicitud WebSocket especialmente dise\u00f1ada, un atacante puede hacer que la aplicaci\u00f3n falle. Si los proveedores intermedios integran este componente de forma incorrecta, el problema puede conducir a un desbordamiento de b\u00fafer."}], "id": "CVE-2025-51495", "lastModified": "2026-11-07T17:10:00.240", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-51495", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-29T19:55:19.399329Z", "version": "2.0.3"}}]}, "published": "2025-09-29T17:15:31.153", "references": [{"source": "cve@mitre.org", "tags": ["Exploit"], "url": "https://github.com/cainiao159357/CVE-2025-51495"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://github.com/cesanta/mongoose"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/cesanta/mongoose/pull/3131"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "mongoose: Integer Overflow in Mongoose's WebSocket component", "id": "2400159", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2400159"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17. By sending a specially crafted WebSocket request, an attacker can cause the application to crash. If downstream vendors integrate this component improperly, the issue may lead to a buffer overflow.", "A vulnerability was identified in the WebSocket component of Mongoose package versions 7.5 through 7.17. An attacker can exploit this flaw by sending a specially crafted request to a targeted application. Successful exploitation results in the application crashing, creating a denial of service. In certain cases where the component is integrated improperly by downstream products, this flaw could lead to a buffer overflow. This more severe condition could potentially allow an attacker to execute arbitrary code on the system."], "name": "CVE-2025-51495", "public_date": "2025-09-29T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-51495\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-51495\nhttp://mongoose.com\nhttps://github.com/cainiao159357/CVE-2025-51495\nhttps://github.com/cesanta/mongoose\nhttps://github.com/cesanta/mongoose/pull/3131"], "statement": "This vulnerability doesn't affect any supported Red Hat product.", "threat_severity": "Moderate"}

{"created": "2025-09-30T08:48:25.583440+00:00", "updated": "2025-09-30T08:48:25.583495+00:00", "vendors": ["cesanta", "cesanta$PRODUCT$mongoose"]}