CVE-2026-115473

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115473", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-22T15:06:52.738Z", "datePublished": "2026-11-04T21:40:39.470Z", "dateUpdated": "2026-11-05T20:02:27.603Z"}, "containers": {"cna": {"title": "Mongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c)", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-158", "lang": "en", "description": "CWE-158: Improper Neutralization of Null Byte or NUL Character", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/cesanta/mongoose/security/advisories/GHSA-cjmx-764f-286c", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/cesanta/mongoose/security/advisories/GHSA-cjmx-764f-286c"}, {"name": "https://github.com/cesanta/mongoose/commit/b55de8b151d1466a3e41d1f854f22eeb6faa23dc", "tags": ["x_refsource_MISC"], "url": "https://github.com/cesanta/mongoose/commit/b55de8b151d1466a3e41d1f854f22eeb6faa23dc"}, {"name": "https://github.com/cesanta/mongoose/releases/tag/7.22", "tags": ["x_refsource_MISC"], "url": "https://github.com/cesanta/mongoose/releases/tag/7.22"}], "affected": [{"vendor": "cesanta", "product": "mongoose", "versions": [{"version": "< 7.22", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-04T21:40:39.470Z"}, "descriptions": [{"lang": "en", "value": "Mongoose is an embedded web server and network library. Prior to 7.22, mg_path_is_sane in src/util.c read path.buf[1] without first requiring path.len to be at least two and read s[2] when only two bytes remained. Unauthenticated remote requests reaching mg_http_upload or mg_http_serve_dir with the affected short path shapes could therefore trigger one-byte heap out-of-bounds reads. On bare-metal or RTOS targets without memory protection, the adjacent byte could be exposed or influence whether a path was accepted, and instrumented builds could crash. This issue is fixed in version 7.22."}], "source": {"advisory": "GHSA-cjmx-764f-286c", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/cesanta/mongoose/security/advisories/GHSA-cjmx-764f-286c", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T20:02:05.668751Z", "id": "CVE-2026-115473", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T20:02:27.603Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-115473", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T20:02:05.668751Z"}}}], "references": [{"url": "https://github.com/cesanta/mongoose/security/advisories/GHSA-cjmx-764f-286c", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T20:02:19.381Z"}}], "cna": {"title": "Mongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c)", "source": {"advisory": "GHSA-cjmx-764f-286c", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "cesanta", "product": "mongoose", "versions": [{"status": "affected", "version": "< 7.22"}]}], "references": [{"url": "https://github.com/cesanta/mongoose/security/advisories/GHSA-cjmx-764f-286c", "name": "https://github.com/cesanta/mongoose/security/advisories/GHSA-cjmx-764f-286c", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/cesanta/mongoose/commit/b55de8b151d1466a3e41d1f854f22eeb6faa23dc", "name": "https://github.com/cesanta/mongoose/commit/b55de8b151d1466a3e41d1f854f22eeb6faa23dc", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/cesanta/mongoose/releases/tag/7.22", "name": "https://github.com/cesanta/mongoose/releases/tag/7.22", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Mongoose is an embedded web server and network library. Prior to 7.22, mg_path_is_sane in src/util.c read path.buf[1] without first requiring path.len to be at least two and read s[2] when only two bytes remained. Unauthenticated remote requests reaching mg_http_upload or mg_http_serve_dir with the affected short path shapes could therefore trigger one-byte heap out-of-bounds reads. On bare-metal or RTOS targets without memory protection, the adjacent byte could be exposed or influence whether a path was accepted, and instrumented builds could crash. This issue is fixed in version 7.22."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-158", "description": "CWE-158: Improper Neutralization of Null Byte or NUL Character"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-04T21:40:39.470Z"}}}, "cveMetadata": {"cveId": "CVE-2026-115473", "state": "PUBLISHED", "dateUpdated": "2026-11-05T20:02:27.603Z", "dateReserved": "2026-10-22T15:06:52.738Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-11-04T21:40:39.470Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mongoose", "vendor": "cesanta", "versions": [{"status": "affected", "version": "< 7.22"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mongoose is an embedded web server and network library. Prior to 7.22, mg_path_is_sane in src/util.c read path.buf[1] without first requiring path.len to be at least two and read s[2] when only two bytes remained. Unauthenticated remote requests reaching mg_http_upload or mg_http_serve_dir with the affected short path shapes could therefore trigger one-byte heap out-of-bounds reads. On bare-metal or RTOS targets without memory protection, the adjacent byte could be exposed or influence whether a path was accepted, and instrumented builds could crash. This issue is fixed in version 7.22."}], "id": "CVE-2026-115473", "lastModified": "2026-11-12T19:18:09.510", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-115473", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T20:02:05.668751Z", "version": "2.0.3"}}]}, "published": "2026-11-04T22:17:50.503", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/cesanta/mongoose/commit/b55de8b151d1466a3e41d1f854f22eeb6faa23dc"}, {"source": "security-advisories@github.com", "url": "https://github.com/cesanta/mongoose/releases/tag/7.22"}, {"source": "security-advisories@github.com", "url": "https://github.com/cesanta/mongoose/security/advisories/GHSA-cjmx-764f-286c"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/cesanta/mongoose/security/advisories/GHSA-cjmx-764f-286c"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-158"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "mongoose: Mongoose: Denial of service via out-of-bounds read during path validation", "id": "2567653", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567653"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "status": "draft"}, "cwe": "CWE-125", "details": ["Mongoose is an embedded web server and network library. Prior to 7.22, mg_path_is_sane in src/util.c read path.buf[1] without first requiring path.len to be at least two and read s[2] when only two bytes remained. Unauthenticated remote requests reaching mg_http_upload or mg_http_serve_dir with the affected short path shapes could therefore trigger one-byte heap out-of-bounds reads. On bare-metal or RTOS targets without memory protection, the adjacent byte could be exposed or influence whether a path was accepted, and instrumented builds could crash. This issue is fixed in version 7.22.", "A flaw was found in Mongoose. Due to missing length validation during path sanitization, an unauthenticated remote attacker can trigger a heap out-of-bounds read by sending specially crafted HTTP requests with malformed short paths. This allows the application to read memory beyond allocated buffer boundaries, which may lead to a denial of service (DoS) by causing the service to crash, or result in information disclosure."], "mitigation": {"lang": "en:us", "value": "Limit network access to applications embedding Mongoose by restricting exposure to trusted networks or localhost using firewall rules, and avoid exposing directory listing or file upload handlers to untrusted clients.\nTo restrict incoming traffic on the application port using firewalld:\n1. Allow access only from trusted IP addresses or subnets:\nfirewall-cmd --permanent --zone=public --add-rich-rule='rule family=\"ipv4\" source address=\"<trusted_ip_or_subnet>\" port port=\"<port>\" protocol=\"tcp\" accept'\n2. Apply the firewall configuration:\nfirewall-cmd --reload\nCaveats: Restricting network traffic will prevent unauthenticated external clients from reaching the service. Reloading firewalld may temporarily disrupt active network sessions."}, "name": "CVE-2026-115473", "public_date": "2026-11-04T21:40:39Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-115473\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115473\nhttps://github.com/cesanta/mongoose/commit/b55de8b151d1466a3e41d1f854f22eeb6faa23dc\nhttps://github.com/cesanta/mongoose/releases/tag/7.22\nhttps://github.com/cesanta/mongoose/security/advisories/GHSA-cjmx-764f-286c"], "statement": "This vulnerability is evaluated as Moderate severity because it is constrained to localized denial of service or minor memory disclosure, without enabling arbitrary code execution or state modification. In standard Linux deployment environments, process-level virtual memory protections limit the blast radius of a single-byte read beyond buffer bounds, typically causing a crash only if an unmapped page boundary is crossed. Furthermore, exposure is contingent upon an application specifically serving directory contents or handling file uploads over untrusted network interfaces.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,7.22)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "mongoose", "source": "cna", "vendor": "cesanta"}, "product": "mongoose", "vendor": "cesanta"}], "created": "2026-11-04T22:45:14.983958+00:00", "updated": "2026-11-04T22:45:15.218302+00:00", "vendors": ["cesanta", "cesanta$PRODUCT$mongoose"]}