TLS Certificate Parsing Vulnerability in Mongoose Embedded Web Server
CVE-2026-73260

7.5HIGH

Key Information:

Vendor

Cesanta

Status
Mongoose
Vendor
CVE Published:
14 October 2026

What is CVE-2026-73260?

The Mongoose embedded web server and network library has a vulnerability in its built-in TLS certificate parser prior to version 7.23. This vulnerability allows for the potential of an out-of-bounds read during the TLS handshake, where an attacker can exploit poorly verified lengths in the DER certificate processing to execute a denial of service attack. As a result, unauthorized malicious TLS servers may trigger the issue, leading to instability in server operations. This vulnerability has been addressed in version 7.23.

Affected Version(s)

mongoose < 7.23

References

https://github.com/cesanta/mongoose/security/advisories/G...
x_refsource_CONFIRM
https://github.com/cesanta/mongoose/commit/a8b4ae95db3c2d...
x_refsource_MISC
https://github.com/cesanta/mongoose/releases/tag/7.23
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.