Mongoose Embedded Web Server Vulnerability in IPv6 Handling by Cesanta
CVE-2026-63626

8.8HIGH

Key Information:

Vendor

Cesanta

Status
Mongoose
Vendor
CVE Published:
14 October 2026

What is CVE-2026-63626?

The Mongoose embedded web server and network library contains a vulnerability that affects its handling of IPv6 configuration over PPP (Point-to-Point Protocol). In versions prior to 7.23, the function ppp_handle_ipv6cp() does not validate the 16-bit IPv6CP length field against the actual size of the received payload. As a result, an unauthenticated adjacent peer could exploit this flaw by completing the necessary link control protocol (LCP) exchange and sending a malformed Configure-Request message with an oversized length parameter. This improper validation may lead to buffer overflows during the packet transmission process, potentially exposing sensitive adjacent memory (heap bytes) and causing disruption in the event loop. Users are advised to update to version 7.23 or later to mitigate this security risk.

Affected Version(s)

mongoose < 7.23

References

https://github.com/cesanta/mongoose/security/advisories/G...
x_refsource_CONFIRM
https://github.com/cesanta/mongoose/commit/751f14742dea93...
x_refsource_MISC
https://github.com/cesanta/mongoose/releases/tag/7.23
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.