CVE-2025-51495

An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17. By sending a specially crafted WebSocket request, an attacker can cause the application to crash. If downstream vendors integrate this component improperly, the issue may lead to a buffer overflow.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/51xxx/CVE-2025-51495.json",
    "cna_assigner": "mitre"
}

References

Affected packages

Git / github.com/cesanta/mongoose

Affected ranges

Type

GIT

Repo

https://github.com/cesanta/mongoose

Events

Introduced

9d38e26b817b6b151fd925e9a8420a46c99a8375

Last affected

0a86bc0af22173b8c952c11551a067fd6f843d83

Database specific

{
    "cpe": "cpe:2.3:a:cesanta:mongoose:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "7.5"
        },
        {
            "last_affected": "7.17"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

7.*

7.11

7.12

7.13

7.14

7.15

7.16

7.17

7.5

7.6

7.7

7.8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-51495.json"