AIKIDO-2026-506847
cesanta.mongoose is vulnerable to Heap-based Buffer Overflow
88
High Risk
This Affects:
cesanta.mongooseTL;DR
The built-in TCP/IP stack's PPP IPv6CP handler reads a length field from an incoming configuration frame and reuses it without checking it against the received payload size. A crafted frame drives a large out-of-bounds read from the receive buffer and a heap buffer overflow into the transmit buffer, and certain lengths hang the event loop. An unauthenticated peer on a PPP or PPPoE link can disclose memory, corrupt the heap, or deny service. The fix rejects lengths larger than the received frame.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you enable the built-in TCP/IP stack (MG_ENABLE_TCPIP) with IPv6 over a PPP or PPPoE link.
Background info
cesanta.mongoose is vulnerable to Heap-based Buffer Overflow in versions 7.22 - 7.22.
How to fix this
Upgrade the cesanta.mongoose library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant