VulnSocial

CVE-2026-5244Disclosure(cesanta / mongoose)

LOWCVSS 9.8 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mongoose.c of the component TLS 1.3 Handler. Such manipulation of the argument pubkey leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.21 mitigates this issue. The name of the patch is 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

cesanta CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-119CWE-122

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • mongoose

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked at 2 mentions on most recent observed day (2026-04-02)
  • 3 total mentions across 2 days

Affected systems

Vendors
cesanta
Products
mongoose

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-03-31: 1Mentions · 2026-04-02: 2Technical Details · 2026-04-02: 203-3104-02
Signal classification2 categories
Disclosure
266.7%
General
133.3%
Referenced assets1 URL
By indicator
Classification over time
DateTotalLabels
2026-03-311
General1
2026-04-022
Disclosure2
Full discourse3 posts
  • Simone Margaritelli@evilsocket
    Disclosure

    Mongoose network library <= 7.20 CVE-2026-5244 - mg_tls_recv_cert pubkey heap-based overflow (exploitable) CVE-2026-5245 - mDNS Record stack-based overflow (exploitable) CVE-2026-5246 - authorization bypass via P-384 Public Key (trivially exploitable) Fun ride. https://t.co/KUBymdWrJF

    Post summary

    The tweet announces three CVEs (CVE‑2026‑5244, CVE‑2026‑5245, CVE‑2026‑5246) in the Mongoose network library (≤7.20) and characterizes them as heap‑based overflow, stack‑based overflow, and a trivially exploitable authorization bypass.

    2101401524.5K
    47.9K followersView on X
  • Simone Margaritelli@evilsocket
    General

    CVE-2026-5244, CVE-2026-5245 and CVE-2026-5246 🥳🎉

    Post summary

    The tweet merely lists CVE identifiers with celebratory emojis, providing no additional detail about the vulnerabilities, exploits, or mitigations.

    1002246.7K
    47.9K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-5244 A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mongoose.c of the component TLS 1.3 Handler. Such … https://www.cve.org/CVERecord?id=CVE-2026-5244

    Post summary

    CVE-2026-5244 exposes a flaw in the mg_tls_recv_cert function of Cesanta Mongoose’s TLS 1.3 handler, affecting versions up to 7.20.

    00000100
    56.9K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appcesantamongoose---

Explore more

Back to dashboardcesanta CVEsmongoose vulnerabilities