CVE-2026-5244

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-5244
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5244.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-5244
Downstream
Published
2026-04-02T08:00:19.770Z
Modified
2026-07-08T08:05:22.949034887Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Cesanta Mongoose TLS 1.3 mongoose.c mg_tls_recv_cert heap-based overflow
Details

A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mgtlsrecv_cert of the file mongoose.c of the component TLS 1.3 Handler. Such manipulation of the argument pubkey leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.21 mitigates this issue. The name of the patch is 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5244.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-119",
        "CWE-122"
    ]
}
References

Affected packages

Git / github.com/cesanta/mongoose

Affected ranges

Type
GIT
Repo
https://github.com/cesanta/mongoose
Events
Introduced
54250f5fbfa1972b96ef593b457abd6184ea65a0
Fixed
b1c2ffe1a0aa13e3d94075b1a2c66b8b43ac9116
Fixed
0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:cesanta:mongoose:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "7.0"
        },
        {
            "fixed": "7.21"
        }
    ]
}

Affected versions

7.*
7.0
7.1
7.10
7.11
7.12
7.13
7.14
7.15
7.16
7.17
7.18
7.19
7.2
7.20
7.3
7.4
7.5
7.6
7.7
7.8
7.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5244.json"