CVE-2026-11404

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-11404
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11404.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-11404
Downstream
Published
2026-07-09T15:13:40Z
Modified
2026-11-05T08:04:50Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Cesanta Mongoose Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID Parsing
Details

Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function mg_tls_server_recv_hello(), which uses an attacker-controlled session_id_len byte from a TLS ClientHello as a buffer index without validating it against the length of received data. A remote, unauthenticated attacker can send a single crafted ClientHello with an oversized session id length to read past the receive buffer, crashing any HTTPS, MQTTS, or WSS service built on MG_TLS_BUILTIN.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11404.json"
}
References

Affected packages

Git / github.com/cesanta/mongoose

Affected ranges

Type
GIT
Repo
https://github.com/cesanta/mongoose
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c288ac1f38424ffdd4d2fd5e1893fd4962642db3
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "7.22"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "original_tag": "7.22",
            "range": [
                {
                    "fixed": "c288ac1f38424ffdd4d2fd5e1893fd4962642db3"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "7.22"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

Affected versions

3.*
3.2
3.3
3.4
3.5
3.6
3.7
3.8
4.*
4.0
4.1
5.*
5.0
5.1
5.2
5.3
5.4
5.5
5.5_20140120
5.6
6.*
6.0
6.1
6.10
6.11
6.12
6.13
6.14
6.15
6.16
6.17
6.18
6.2
6.3
6.4
6.5
6.6
6.7
6.9
7.*
7.0
7.1
7.11
7.12
7.13
7.14
7.15
7.16
7.17
7.18
7.19
7.2
7.20
7.21
7.3
7.4
7.5
7.6
7.7
7.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11404.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "50831114506767048543783888818053747140",
                "102282831731681611708701943433052444515",
                "107165301612598870386716076318560816275",
                "226496764404165055021297390712437495944"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-11404-0c53d45a",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/cesanta/mongoose/commit/c288ac1f38424ffdd4d2fd5e1893fd4962642db3",
        "target": {
            "file": "mongoose.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "198462346822103079873169023619511485359",
                "92796750520037948003411784031139089264",
                "249198894191349157440931519126450359726",
                "79009763370254885770042584348660902992",
                "294142640487653530778936123422655158620",
                "47249663673204170220620892589402576701",
                "288473947272812043979000637810271025017",
                "177543420564534138283955551342384558661"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-11404-4ecccaad",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/cesanta/mongoose/commit/c288ac1f38424ffdd4d2fd5e1893fd4962642db3",
        "target": {
            "file": "mongoose.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "111249714975642113074656497738378119290",
            "length": 528
        },
        "id": "CVE-2026-11404-7fa6d795",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/cesanta/mongoose/commit/c288ac1f38424ffdd4d2fd5e1893fd4962642db3",
        "target": {
            "file": "mongoose.c",
            "function": "mg_wakeup"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "50831114506767048543783888818053747140",
                "102282831731681611708701943433052444515",
                "107165301612598870386716076318560816275",
                "226496764404165055021297390712437495944"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-11404-84bc28a8",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/cesanta/mongoose/commit/c288ac1f38424ffdd4d2fd5e1893fd4962642db3",
        "target": {
            "file": "src/bsd.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "111249714975642113074656497738378119290",
            "length": 528
        },
        "id": "CVE-2026-11404-add4e76b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/cesanta/mongoose/commit/c288ac1f38424ffdd4d2fd5e1893fd4962642db3",
        "target": {
            "file": "src/bsd.c",
            "function": "mg_wakeup"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "198462346822103079873169023619511485359",
                "92796750520037948003411784031139089264",
                "249198894191349157440931519126450359726",
                "79009763370254885770042584348660902992",
                "294142640487653530778936123422655158620",
                "47249663673204170220620892589402576701",
                "288473947272812043979000637810271025017",
                "177543420564534138283955551342384558661"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-11404-dad311d3",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/cesanta/mongoose/commit/c288ac1f38424ffdd4d2fd5e1893fd4962642db3",
        "target": {
            "file": "src/bsd.c"
        }
    }
]
vanir_signatures_modified 
"2026-11-05T08:04:50Z"