Out-of-Bounds Write Vulnerability in Mongoose HTTPS Server by Cesanta
CVE-2021-26530

9.1CRITICAL

Key Information:

Vendor

Cesanta

Status
Mongoose
Vendor
CVE Published:
8 February 2021

What is CVE-2021-26530?

The mg_tls_init function in Cesanta's Mongoose HTTPS server version 7.0, specifically when compiled with OpenSSL support, is susceptible to a remote out-of-bounds write vulnerability. This flaw could be exploited when a connection request is made following the exhaustion of the server's memory pool, leading to potential corruption of memory and unintended behavior.

References

https://github.com/cesanta/mongoose/issues/1204
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.