CVE-2026-2967

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2967", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-22T07:57:28.584Z", "datePublished": "2026-02-23T02:32:07.568Z", "dateUpdated": "2026-02-23T13:32:57.830Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T02:32:07.568Z"}, "title": "Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of source", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-940", "lang": "en", "description": "Improper Verification of Source of a Communication Channel"}]}], "affected": [{"vendor": "Cesanta", "product": "Mongoose", "versions": [{"version": "7.0", "status": "affected"}, {"version": "7.1", "status": "affected"}, {"version": "7.2", "status": "affected"}, {"version": "7.3", "status": "affected"}, {"version": "7.4", "status": "affected"}, {"version": "7.5", "status": "affected"}, {"version": "7.6", "status": "affected"}, {"version": "7.7", "status": "affected"}, {"version": "7.8", "status": "affected"}, {"version": "7.9", "status": "affected"}, {"version": "7.10", "status": "affected"}, {"version": "7.11", "status": "affected"}, {"version": "7.12", "status": "affected"}, {"version": "7.13", "status": "affected"}, {"version": "7.14", "status": "affected"}, {"version": "7.15", "status": "affected"}, {"version": "7.16", "status": "affected"}, {"version": "7.17", "status": "affected"}, {"version": "7.18", "status": "affected"}, {"version": "7.19", "status": "affected"}, {"version": "7.20", "status": "affected"}], "cpes": ["cpe:2.3:a:cesanta:mongoose:*:*:*:*:*:*:*:*"], "modules": ["TCP Sequence Number Handler"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This affects the function getpeer of the file /src/net_builtin.c of the component TCP Sequence Number Handler. The manipulation leads to improper verification of source of a communication channel. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.7, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-02-22T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-02-22T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-02-22T09:02:38.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "dwbruijn (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.347334", "name": "VDB-347334 | Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of source", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.347334", "name": "VDB-347334 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.755450", "name": "Submit #755450 | Cesanta Mongoose Embedded Web Server 7.20 Improper Validation of Specified Index, Position, or Offset in I", "tags": ["third-party-advisory"]}, {"url": "https://github.com/dwBruijn/CVEs/blob/main/Mongoose/tcp_rst.md", "tags": ["related"]}, {"url": "https://github.com/dwBruijn/CVEs/blob/main/Mongoose/tcp_rst.md#poc", "tags": ["exploit"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-23T13:32:47.660229Z", "id": "CVE-2026-2967", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T13:32:57.830Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2967", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-23T13:32:47.660229Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-23T13:32:51.789Z"}}], "cna": {"tags": ["x_open-source"], "title": "Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of source", "credits": [{"lang": "en", "type": "reporter", "value": "dwbruijn (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:cesanta:mongoose:*:*:*:*:*:*:*:*"], "vendor": "Cesanta", "modules": ["TCP Sequence Number Handler"], "product": "Mongoose", "versions": [{"status": "affected", "version": "7.0"}, {"status": "affected", "version": "7.1"}, {"status": "affected", "version": "7.2"}, {"status": "affected", "version": "7.3"}, {"status": "affected", "version": "7.4"}, {"status": "affected", "version": "7.5"}, {"status": "affected", "version": "7.6"}, {"status": "affected", "version": "7.7"}, {"status": "affected", "version": "7.8"}, {"status": "affected", "version": "7.9"}, {"status": "affected", "version": "7.10"}, {"status": "affected", "version": "7.11"}, {"status": "affected", "version": "7.12"}, {"status": "affected", "version": "7.13"}, {"status": "affected", "version": "7.14"}, {"status": "affected", "version": "7.15"}, {"status": "affected", "version": "7.16"}, {"status": "affected", "version": "7.17"}, {"status": "affected", "version": "7.18"}, {"status": "affected", "version": "7.19"}, {"status": "affected", "version": "7.20"}]}], "timeline": [{"lang": "en", "time": "2026-02-22T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-02-22T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-02-22T09:02:38.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.347334", "name": "VDB-347334 | Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of source", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.347334", "name": "VDB-347334 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.755450", "name": "Submit #755450 | Cesanta Mongoose Embedded Web Server 7.20 Improper Validation of Specified Index, Position, or Offset in I", "tags": ["third-party-advisory"]}, {"url": "https://github.com/dwBruijn/CVEs/blob/main/Mongoose/tcp_rst.md", "tags": ["related"]}, {"url": "https://github.com/dwBruijn/CVEs/blob/main/Mongoose/tcp_rst.md#poc", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This affects the function getpeer of the file /src/net_builtin.c of the component TCP Sequence Number Handler. The manipulation leads to improper verification of source of a communication channel. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-940", "description": "Improper Verification of Source of a Communication Channel"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-23T02:32:07.568Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2967", "state": "PUBLISHED", "dateUpdated": "2026-02-23T13:32:57.830Z", "dateReserved": "2026-02-22T07:57:28.584Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-02-23T02:32:07.568Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:cesanta:mongoose:*:*:*:*:*:*:*:*"], "modules": ["TCP Sequence Number Handler"], "product": "Mongoose", "vendor": "Cesanta", "versions": [{"status": "affected", "version": "7.0"}, {"status": "affected", "version": "7.1"}, {"status": "affected", "version": "7.2"}, {"status": "affected", "version": "7.3"}, {"status": "affected", "version": "7.4"}, {"status": "affected", "version": "7.5"}, {"status": "affected", "version": "7.6"}, {"status": "affected", "version": "7.7"}, {"status": "affected", "version": "7.8"}, {"status": "affected", "version": "7.9"}, {"status": "affected", "version": "7.10"}, {"status": "affected", "version": "7.11"}, {"status": "affected", "version": "7.12"}, {"status": "affected", "version": "7.13"}, {"status": "affected", "version": "7.14"}, {"status": "affected", "version": "7.15"}, {"status": "affected", "version": "7.16"}, {"status": "affected", "version": "7.17"}, {"status": "affected", "version": "7.18"}, {"status": "affected", "version": "7.19"}, {"status": "affected", "version": "7.20"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cesanta:mongoose:*:*:*:*:*:*:*:*", "matchCriteriaId": "83B5780A-1BF9-4983-A2BD-0E278131D841", "versionEndIncluding": "7.20", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This affects the function getpeer of the file /src/net_builtin.c of the component TCP Sequence Number Handler. The manipulation leads to improper verification of source of a communication channel. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se ha detectado una vulnerabilidad de seguridad en Cesanta Mongoose hasta la versi\u00f3n 7.20. La cual afecta a la funci\u00f3n getpeer del archivo /src/net_builtin.c del componente Gestor de N\u00fameros de Secuencia TCP. Si se manipula se puede provocar una verificaci\u00f3n incorrecta del origen de un canal de comunicaci\u00f3n. El ataque puede ser iniciado de forma remota. Est\u00e1 calificado de complejidad alta y dif\u00edcil de explotar. El exploit ha sido divulgado p\u00fablicamente y puede ser utilizado. El proveedor fue contactado con antelaci\u00f3n sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-2967", "lastModified": "2026-06-17T10:32:08.143", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 2.6, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2967", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-23T13:32:47.660229Z", "version": "2.0.3"}}]}, "published": "2026-02-23T04:16:02.040", "references": [{"source": "cna@vuldb.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/dwBruijn/CVEs/blob/main/Mongoose/tcp_rst.md"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/dwBruijn/CVEs/blob/main/Mongoose/tcp_rst.md#poc"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.347334"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.347334"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.755450"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-940"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.11"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.12"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.13"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.14"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.15"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.16"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.17"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.18"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.19"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.20"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Mongoose", "source": "cna", "vendor": "Cesanta"}, "product": "mongoose", "vendor": "cesanta"}], "analysis": {"en": {"generated_at": "2026-04-17T16:23:52.941714+00:00", "value": {"mitigation_remediation": ["Upgrade Cesanta\u202fMongoose to a release that contains the fix (any version higher than 7.20).", "If an upgrade is not immediately possible, implement firewall rules that restrict unsolicited TCP reset traffic to the application or limit reset handling in the network path.", "Continuously monitor vendor advisories and security bulletins for an official patch, and apply it as soon as it becomes available."], "summary": {"action": "Update Immediately", "impact": "Impairment of source verification in TCP sequence handling allowing remote exploitation"}, "threat_synthesis": {"affected_systems": "Cesanta\u202fMongoose versions up to and including 7.20 are affected. All deployments that use these versions without an update to a later release may be vulnerable. No specific patch information is available from the vendor, and the vendor has not responded to the disclosure.", "description_and_impact": "The vulnerability resides in the getpeer function of src/net_builtin.c within Cesanta\u202fMongoose, affecting TCP sequence number handling. It allows an attacker to manipulate network traffic such that the source of a communication channel is not properly verified, potentially permitting spoofed connections or hijacked sessions. This flaw can be triggered remotely, has a high attack complexity rating, and is reported as difficult to exploit, yet the vulnerability has been publicly disclosed and could be used in real\u2011world attacks.", "risk_and_exploitability": "The CVSS base score of 6.3 indicates moderate severity, and the EPSS rating of <1% suggests a low probability of exploitation in recent data. The vulnerability is not listed in the CISA KEV catalog, but its public disclosure and remote nature mean that it could be leveraged by attackers who succeed in traversing network boundaries. The high attack complexity and reported difficulty reduce the likelihood of immediate widespread exploitation, but the lack of vendor response and absence of a published fix warrant proactive monitoring and preparation for a future remediation."}}}}, "created": "2026-02-23T14:28:23.177518+00:00", "updated": "2026-04-17T16:30:05.831174+00:00", "vendors": ["cesanta", "cesanta$PRODUCT$mongoose"]}