A vulnerability was determined in Cesanta Mongoose up to 7.20. Affected is the function mgtlsverifycertsignature of the file mongoose.c of the component P-384 Public Key Handler. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. Attacks of this nature are highly complex. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 7.21 is able to address this issue. This patch is called 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
{
"cwe_ids": [
"CWE-285",
"CWE-639"
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5246.json",
"cna_assigner": "VulDB"
}[
{
"target": {
"file": "src/str.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"310195857280588516826327302251308476623",
"247067085422557109988189947515934599102",
"313811670961247816809835158680447031175",
"321039469075947274274862094326940937842",
"149204095977579775158569319523296377014",
"37415825601299739301022543248796799547",
"222981842113018445298086962150850787644",
"227108120022272002364766608411054073442",
"305162833108134619902342219290277501935"
],
"threshold": 0.9
},
"id": "CVE-2026-5246-002f53b6",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "getpeer",
"file": "src/net_builtin.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "93212850972103637565164108427977558",
"length": 903.0
},
"id": "CVE-2026-5246-0e3743ab",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "mg_tls_recv_record",
"file": "src/tls_builtin.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "63904093970639459445221502944134231697",
"length": 2376.0
},
"id": "CVE-2026-5246-0ec0c030",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "handle_mdns_query",
"file": "src/dns.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "234094490269337275516703077143475779957",
"length": 4366.0
},
"id": "CVE-2026-5246-1d8d5131",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"file": "src/json.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"200971470672070433806574787162350782981",
"246459084421158409508271879636616685473",
"178497673632907847985424603495005254580",
"147625765234870644987741089606512115234",
"125608274239893015702254416244430154117",
"106674142984676130989977692530078834796",
"317818015869759693059115042658936654867",
"249683910300377170747782883355612564449",
"130718674766101239475935730716936852871",
"250665637455326381798507422100577635451",
"181062300907135882941523102720798240188",
"198632693690028902544562145243396211538"
],
"threshold": 0.9
},
"id": "CVE-2026-5246-1ecae67e",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "mg_chacha20_poly1305_decrypt",
"file": "mongoose.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "214187038073003652483917653332949765372",
"length": 359.0
},
"id": "CVE-2026-5246-334b820d",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"file": "src/http.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"72108969968671287165676073113908540097",
"260764798821274886585180251291715723352",
"311516043145510413929413847446881645078",
"33408407914328545099672704711216714115",
"180159965983064713659004726001301644810",
"75864077088983988380883324682721108431",
"283514182450017727361918624070024043260",
"174545628510337453787793780372496772280",
"169280853188626589078984246568509550670",
"249274382086140367465238988260062558767",
"283298895752339736303522186100799821953",
"309370920187928618663289771021288202439",
"40326253743574648834541450959435781468",
"168036368398611063048019074455283493565",
"142041783403648622183734022793455247935",
"337785171986507366427061745683328845438"
],
"threshold": 0.9
},
"id": "CVE-2026-5246-37675a34",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"file": "src/tls_aes128.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"166377927564541163292838571970413559447",
"167263868293715453694677016447384973503",
"506666656578193056911612979893655164",
"46148227840654825310039885552784555514",
"51486828226111308951402893970210295231",
"264778674555001533239524250037403968916",
"270184295426408907650816603346375894996",
"215483416289239105373085481951564675827",
"104522920709814054877500805439768270288",
"144422475653927737875015228092684653629",
"322158298067059941551515647401405828285",
"64138746259907601956727958666149641080",
"178740577980772207894443934468463984962",
"105092733098238568528332336540088977162",
"214107427827052325797984003184624248193",
"69851016955281771236625038635337133031",
"339531381409716696330867507336020855523",
"65435455913219771565833736959607063610",
"111243338608708823626753390781387202342",
"115240527536752730628919954176480783101",
"106631365053193492567279455858649416064",
"280098514755188230095378998464723237835",
"99618655361699004483939623708081829375",
"4360123043167917805668550763739904861",
"279479400312961436471337999409879455622",
"106877907065056045032335256425728047154",
"17414785322227276591322205728357532476",
"197373848301137846789942809445978967177",
"130403767094565810059314586724407927819",
"196192752971554878422409343007146370882",
"161912795029919786466536487177815230373",
"313060015622709387875202425946162945281",
"102947552618209418802711564820465321146",
"145457683343268548700386219445880502576",
"183620710663677804024233103701738885573",
"89907086326744855360949479765887958690",
"291312107145074695395514728944773432558",
"136753443340113592476679800288972712523",
"153727050990137812601449015336433060",
"197373848301137846789942809445978967177",
"130403767094565810059314586724407927819",
"255997722559097574620098256938064459576",
"68441160989040999281218388098010292829",
"176364859884227006479435786866928776958",
"201970721734579392239978390934633053295",
"151903328359582460231684335964360945870",
"59784093424306230654489344977207941672",
"20459915730428632493000693870709414169",
"336891102694408727580294786460490492846",
"253066278568950610856613401423838628589",
"288519642934558429790274657646736142116",
"192950257664883424999665004016645343714",
"227692618715369704900486678700455716040",
"119835196798782698214675597940995916024",
"149959037209250504984573260640700311401",
"53440401303995629403167703346471190787",
"119937427392194843040101836720800183858",
"198651752223389311820485040931269337192",
"182843108111491156423179287511188709866",
"308096605264013075853203281581807228145",
"325664619094998110495016418461489040101",
"319673650985324470133391415129032394452",
"144341530506010183333599235500716821018",
"49278945284522362513512276157546683389",
"129078828322242766157744059378519575736",
"28995880903155359770291047592393350448",
"40248016499411324772936725175663917177",
"85830320658122008453931200049403595609",
"137072781728853895650709960612190898863",
"219509552520569974583868360379305148190",
"304039564119088992804837457483142251692",
"144619208310535700653644465224373393455",
"185114827034937651856759847614992037655",
"228962712326204502214534772493765657497",
"176051746526868922004708321265090266966",
"201351983955584124501811455184160855453",
"9717702707779021863191611012024236828",
"43199056793610057593470496448828042193",
"6387626515404289903668457435571969384",
"178921450425415670519636632384688864145",
"196080506392537515488654746137652339829",
"34351323083193096245147860890525456216",
"134121993364193601747587344845061586518",
"332543323218532773519721895809380387312",
"165057652202163109821447694896803368600",
"239762466145717511716095682099779631116",
"322501024171695313234747172346106582517",
"309639282658930118807757630254151884911",
"204449800585054548665976681966719287518",
"229406716550729854616854281091187549102",
"154646946888285830375041585279800935383",
"130403767094565810059314586724407927819",
"229742653753630732464442005697011253097",
"331995379878877217878850897274991006390",
"169886523696035793676584177521827040463",
"326158733109933740054880516740051512951",
"234977086816461752370272038996644408562",
"232133542465668876511338012523769502509",
"288397624057430317718997494261702689139",
"325242640091815937285587536620593635395",
"130553713330864471846461556197186375429",
"229504831672449379676664202288999503218",
"167321859259145648050516547002004208569",
"57520888438582709270617047040213417495",
"218462915735236157791431207526385213565",
"60799445943604303072501754996526339645",
"122412311292082891844336300896486201644",
"205456425187426697100923213663666654715",
"49765367646455232078917279035073459284",
"80130330068159578638735865439939197065",
"315521241088836446456775058804680164436",
"65669592043857257360248864363185040550",
"102063872272642114647774797723170125883",
"275895958113250507901860690710246457359",
"122428424209887601494894338344224599765",
"257751835932933136622186542807896372935",
"305784875714126238500743948510862222467",
"129547477544933903033812222570515669753",
"15352954243688528104588705144441788556",
"144115131550790457788910321250686705876",
"49978805059545097954884005882458143256",
"23250451491765428539007771795079749346",
"152214101953756332536064471755266980175",
"197373848301137846789942809445978967177",
"130403767094565810059314586724407927819",
"196192752971554878422409343007146370882",
"161912795029919786466536487177815230373",
"313060015622709387875202425946162945281",
"102947552618209418802711564820465321146",
"145457683343268548700386219445880502576",
"280079081856563274202551860518015018526",
"211563150602212992110398059453408414483",
"199736824015900594826414012002118820382",
"176214915471096570480532147860006032354",
"31152260146556919759251662321424465188",
"184832668949504045014052529723378681893",
"263813225561990235673600640433482389857",
"267817553872908336145889358850062647820",
"32273153666901610190369914424465501245",
"27294903347538329529402148146838170769",
"191460036879827331686641467321804726056",
"322569136946990160170440770186660535129",
"236300839855015201227158373780934111304",
"102547778772310280041461417180563970666",
"58023291585700350463479550252972376958",
"105004090105507035888345514893264189628",
"229037425458627743139081883241966980319"
],
"threshold": 0.9
},
"id": "CVE-2026-5246-3c9f116d",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "mg_aes_gcm_decrypt",
"file": "mongoose.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "284887395322274163673066262777896413487",
"length": 463.0
},
"id": "CVE-2026-5246-3d30d8c3",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "mg_http_parse",
"file": "mongoose.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "169482835391483632511920415400433157767",
"length": 2650.0
},
"id": "CVE-2026-5246-3eb57fc8",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "getpeer",
"file": "mongoose.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "93212850972103637565164108427977558",
"length": 903.0
},
"id": "CVE-2026-5246-479db182",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"file": "mongoose.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"56933431865281245213749287497782426521",
"303455783710560512343753439937641764898",
"303036824976635134908619449919295352721",
"124624454585074621904655830844712295340",
"6561407956898520786756777653896360563",
"294767461588999872490539531261252552715",
"23097913862147064676774561498425477377",
"306523893688106675536856035552690638391",
"243495406190095439628900850650457985285",
"317946814191474380836591343945907763614",
"314613284483198612553273371780820677253",
"49245216544456347606491959242059417274",
"116778585826418716170303821370250569511",
"336779140437804735905696204924253960839",
"288742116191864459027792656216763133013",
"274327277407508615029546726014812101136",
"332434401912874281430537741122661571567",
"96682559737486944154620655856227149850",
"186622395465038987129288798280409578170",
"310262615795520725550552141501401027813",
"90140572750714774861170194468280871621",
"9244300532616723394411416325184703516",
"19421017225838431121908650094444156603",
"324506443357838879115357657624328182267",
"264065705563480245840999412235584828772",
"26704613209502569353250967690759012161",
"225562100587811317871462542191747469555",
"67985329392020918420900606674817271804",
"97004733065197985112623089887963163096",
"259882351367768646477379968160817102341",
"143842239969820188343810213868778165631",
"73076231494370559425061270848247044790",
"19712610702678678138750778101373063399",
"2051417963277628477041207900031468320",
"193448156027838352693970725127156933391",
"67789153380471409382296741380926711709",
"116982958919005443406061642463119178464",
"28665900490105171143675497991351535105",
"325619045586590384971353053271400495031",
"322203366176116302694913581834816233959",
"144906567610331951298645834025178090357",
"275665191346582512226813004861224494875",
"72108969968671287165676073113908540097",
"260764798821274886585180251291715723352",
"311516043145510413929413847446881645078",
"33408407914328545099672704711216714115",
"180159965983064713659004726001301644810",
"75864077088983988380883324682721108431",
"283514182450017727361918624070024043260",
"174545628510337453787793780372496772280",
"169280853188626589078984246568509550670",
"249274382086140367465238988260062558767",
"283298895752339736303522186100799821953",
"309370920187928618663289771021288202439",
"40326253743574648834541450959435781468",
"168036368398611063048019074455283493565",
"142041783403648622183734022793455247935",
"337785171986507366427061745683328845438",
"200971470672070433806574787162350782981",
"246459084421158409508271879636616685473",
"178497673632907847985424603495005254580",
"147625765234870644987741089606512115234",
"125608274239893015702254416244430154117",
"106674142984676130989977692530078834796",
"317818015869759693059115042658936654867",
"249683910300377170747782883355612564449",
"130718674766101239475935730716936852871",
"250665637455326381798507422100577635451",
"181062300907135882941523102720798240188",
"198632693690028902544562145243396211538",
"272875052070693849567175882970796503685",
"174941304266970034908803404708417986504",
"325515677634887295009015740223415991206",
"240725051084142377963379210491230460651",
"47544155738714589444398018000181882915",
"151565062581388220393578371932084491774",
"176098472037468993123272496858262969410",
"108346869045048453734231298880138200202",
"189129425145615302855593228033943661238",
"284962362096635507392671394059090607698",
"240167769881959622628575733234518246276",
"283820486452260436020555651767874538701",
"210657630259912825272204683103627078739",
"81748695825459609641546607910337680488",
"150839986079736642515317212731311896185",
"147217562461486180854542751445272124903",
"135740491520311850831727720038686505364",
"330930823638739834615971735556405304892",
"90808821232669300321627953952310089261",
"297100237347864914058579389636219061668",
"185558195117700871259561021492392876903",
"138945797621036858455502679664416451494",
"295859711013190854541264736561792026554",
"186946175742719696572222920641736691621",
"80563253276249374257502444141571543685",
"268898602923381710079666002836502702604",
"54008277736932128131107790654075355512",
"46446964086344257330151622362710422138",
"294088950994057299953349670765794449815",
"277815336795832074581049057704211114881",
"310195857280588516826327302251308476623",
"247067085422557109988189947515934599102",
"313811670961247816809835158680447031175",
"321039469075947274274862094326940937842",
"149204095977579775158569319523296377014",
"37415825601299739301022543248796799547",
"222981842113018445298086962150850787644",
"227108120022272002364766608411054073442",
"305162833108134619902342219290277501935",
"58964711037780293404320652355226086804",
"9437876396204833801476030157924316578",
"506666656578193056911612979893655164",
"46148227840654825310039885552784555514",
"51486828226111308951402893970210295231",
"264778674555001533239524250037403968916",
"270184295426408907650816603346375894996",
"215483416289239105373085481951564675827",
"104522920709814054877500805439768270288",
"144422475653927737875015228092684653629",
"322158298067059941551515647401405828285",
"64138746259907601956727958666149641080",
"178740577980772207894443934468463984962",
"105092733098238568528332336540088977162",
"214107427827052325797984003184624248193",
"69851016955281771236625038635337133031",
"339531381409716696330867507336020855523",
"65435455913219771565833736959607063610",
"111243338608708823626753390781387202342",
"115240527536752730628919954176480783101",
"106631365053193492567279455858649416064",
"280098514755188230095378998464723237835",
"99618655361699004483939623708081829375",
"4360123043167917805668550763739904861",
"279479400312961436471337999409879455622",
"106877907065056045032335256425728047154",
"17414785322227276591322205728357532476",
"197373848301137846789942809445978967177",
"130403767094565810059314586724407927819",
"196192752971554878422409343007146370882",
"161912795029919786466536487177815230373",
"313060015622709387875202425946162945281",
"102947552618209418802711564820465321146",
"145457683343268548700386219445880502576",
"183620710663677804024233103701738885573",
"89907086326744855360949479765887958690",
"291312107145074695395514728944773432558",
"136753443340113592476679800288972712523",
"153727050990137812601449015336433060",
"197373848301137846789942809445978967177",
"130403767094565810059314586724407927819",
"255997722559097574620098256938064459576",
"68441160989040999281218388098010292829",
"176364859884227006479435786866928776958",
"201970721734579392239978390934633053295",
"151903328359582460231684335964360945870",
"59784093424306230654489344977207941672",
"20459915730428632493000693870709414169",
"336891102694408727580294786460490492846",
"253066278568950610856613401423838628589",
"288519642934558429790274657646736142116",
"192950257664883424999665004016645343714",
"227692618715369704900486678700455716040",
"119835196798782698214675597940995916024",
"149959037209250504984573260640700311401",
"53440401303995629403167703346471190787",
"119937427392194843040101836720800183858",
"198651752223389311820485040931269337192",
"182843108111491156423179287511188709866",
"308096605264013075853203281581807228145",
"325664619094998110495016418461489040101",
"319673650985324470133391415129032394452",
"144341530506010183333599235500716821018",
"49278945284522362513512276157546683389",
"129078828322242766157744059378519575736",
"28995880903155359770291047592393350448",
"40248016499411324772936725175663917177",
"85830320658122008453931200049403595609",
"137072781728853895650709960612190898863",
"219509552520569974583868360379305148190",
"304039564119088992804837457483142251692",
"144619208310535700653644465224373393455",
"185114827034937651856759847614992037655",
"228962712326204502214534772493765657497",
"176051746526868922004708321265090266966",
"201351983955584124501811455184160855453",
"9717702707779021863191611012024236828",
"43199056793610057593470496448828042193",
"6387626515404289903668457435571969384",
"178921450425415670519636632384688864145",
"196080506392537515488654746137652339829",
"34351323083193096245147860890525456216",
"134121993364193601747587344845061586518",
"332543323218532773519721895809380387312",
"165057652202163109821447694896803368600",
"239762466145717511716095682099779631116",
"322501024171695313234747172346106582517",
"309639282658930118807757630254151884911",
"204449800585054548665976681966719287518",
"229406716550729854616854281091187549102",
"154646946888285830375041585279800935383",
"130403767094565810059314586724407927819",
"229742653753630732464442005697011253097",
"331995379878877217878850897274991006390",
"169886523696035793676584177521827040463",
"326158733109933740054880516740051512951",
"234977086816461752370272038996644408562",
"232133542465668876511338012523769502509",
"288397624057430317718997494261702689139",
"325242640091815937285587536620593635395",
"130553713330864471846461556197186375429",
"229504831672449379676664202288999503218",
"167321859259145648050516547002004208569",
"57520888438582709270617047040213417495",
"218462915735236157791431207526385213565",
"60799445943604303072501754996526339645",
"122412311292082891844336300896486201644",
"205456425187426697100923213663666654715",
"49765367646455232078917279035073459284",
"80130330068159578638735865439939197065",
"315521241088836446456775058804680164436",
"65669592043857257360248864363185040550",
"102063872272642114647774797723170125883",
"275895958113250507901860690710246457359",
"122428424209887601494894338344224599765",
"257751835932933136622186542807896372935",
"305784875714126238500743948510862222467",
"129547477544933903033812222570515669753",
"15352954243688528104588705144441788556",
"144115131550790457788910321250686705876",
"49978805059545097954884005882458143256",
"23250451491765428539007771795079749346",
"152214101953756332536064471755266980175",
"197373848301137846789942809445978967177",
"130403767094565810059314586724407927819",
"196192752971554878422409343007146370882",
"161912795029919786466536487177815230373",
"313060015622709387875202425946162945281",
"102947552618209418802711564820465321146",
"145457683343268548700386219445880502576",
"280079081856563274202551860518015018526",
"211563150602212992110398059453408414483",
"199736824015900594826414012002118820382",
"176214915471096570480532147860006032354",
"31152260146556919759251662321424465188",
"184832668949504045014052529723378681893",
"263813225561990235673600640433482389857",
"267817553872908336145889358850062647820",
"32273153666901610190369914424465501245",
"27294903347538329529402148146838170769",
"191460036879827331686641467321804726056",
"322569136946990160170440770186660535129",
"236300839855015201227158373780934111304",
"102547778772310280041461417180563970666",
"58023291585700350463479550252972376958",
"105004090105507035888345514893264189628",
"229037425458627743139081883241966980319",
"339994179691324067704548755171150621086",
"292816727867213137241220607084019249881",
"115163519840789643773573514817908554262",
"52656032325957364131554071512861025468",
"168726446307564999387028906064870247981",
"164393121173833428582681818186604154089",
"128840611111896029413418295319592257290",
"117919650635928773786702254063542722384",
"331748457844263975774843423516844136484",
"10299790149863837467398885079323728634",
"133031934407816907640259478827773757363",
"127727766903060323082876207448424436262",
"332627427076818448656501346353500451857",
"197271039286460923839245118406935146943",
"280530562517149823643776051246068845765",
"232121593093810813270917944440099007756",
"146050256032827791610710580688900516071",
"329505966588041481371488711060843801039",
"139943472294742398921276591779247270454",
"211630267777897024369314983351812191669",
"143121139624474137479755660008422789602",
"278545133255467574925410929694638865755",
"34493112195234884334933821281064781200",
"148610498549762889717004973256217423141",
"113651584397507884552203427338154868104",
"249469841276797515693095052882972063250",
"227981912956658099610886095835513324290",
"4013314329601652871938402301567531850",
"127688218017202541856626972076064578951",
"268448129425082683312835155095326730006",
"278675231599958880132844965898593265451",
"145391048498550237254294328942577741054",
"175785920547605025903083673681931507177",
"112887602175785218215727790862607116977",
"211501764689793163843921429535111953433",
"56192890385092876449122461616572299313",
"180166381661433559618913587768413906166",
"86671909889508757942757906751299464277",
"288685814597346261261024784673007913377",
"208540302627622567701609919381829610627",
"308973565140169985853590614608832626669",
"340177776924663054721258530754734619376",
"141898069335864065341824762355327147084",
"163478267167680265790633447886385166179",
"172266484631433410678996138377744150275",
"288408347785360325098529331447392584828",
"299804082750032730164740057256852684493",
"317889136142439194457672805800554329256",
"11198144294321269404455436663924387432",
"188406693863049931447102968283248071383",
"82640399190652379891482606387304947109",
"261467906350646052955097477097071774313",
"224579684604879701433326967871115585145",
"218738675711252010320321931948940263807",
"267399372645606655407081159165455612008",
"306669156786746193942396316066334355421",
"148075135791548817664381439903438766335",
"293665662732071792121171071094380571570",
"295230499844304224415280077334956472484",
"212486963107155032308919581914730950630",
"80979985351413094348471070095489128866",
"330462188675994544967312945304748867699",
"179557291430156444174196948696794994927",
"23408693580845899365845328933754551603",
"219548503678408471025861847291671100948",
"295230499844304224415280077334956472484",
"238514820134418407276834849572934856498",
"120151478661977389860112505950148286347",
"126637918579228009693165287988171011937",
"329940228525569355667064047676155503160",
"138964223778760859751683698195611113395",
"109697911010499671605364282942207118731",
"286718235630277074047459233258413272978",
"128196217974659585650278628768051761342",
"58193428203198968228937992105361911181",
"168835970645394128340244412430549740145",
"148448165703134266156797568887494611204",
"111699303742315830928980711537758271661",
"274994703168481489445931894695666404524",
"42320537998981901654273763762274420190",
"251553503147214024625448007237643122058",
"227786675809996272858477768582552330852",
"141678746247591748580920649705550734869",
"188842102269008906478609187553341740047",
"125171629189675101503180477527288853850",
"258831572389871075508268819855872135361",
"67502928094642593500731059722146586324",
"265734769265306628708510081328851984075",
"241265352231720069307040971674185507195",
"157263359436730301174576694286622566290"
],
"threshold": 0.9
},
"id": "CVE-2026-5246-47c17c8f",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "rx_tcp",
"file": "src/net_builtin.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "4701345775393380708352978062411143252",
"length": 2644.0
},
"id": "CVE-2026-5246-4af02874",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "handle_opt",
"file": "src/net_builtin.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "102027882861119357625942818285383242107",
"length": 561.0
},
"id": "CVE-2026-5246-50e79370",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"file": "test/unit_test.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"20333685831321025613166579583783134420",
"193612862579461182524916428303822579161",
"99129684687679978660615210059742279119",
"250756933803491156136098182880977834173",
"328383317207347260532997482585937157429",
"289240339120596722481479293259450469038",
"120519121627839656708195254305511516996",
"193211685255284766619601582133415552597",
"130893935940066303983165677155287350090",
"79920726599156702382919114007541284764",
"170530877469794623609660069260444607947",
"217028554964648763586556222942173612783",
"126590371730607760672704040885470524591",
"79212480672582253977130130603176271528",
"314607484840485571386936771021675918807",
"160483758676961072924155259067019991021",
"101591178555718284102179748474383516499",
"192204867219150616545108262507762865232",
"269493921300421210455410426748437311014",
"191887931081936735754045701036845515850",
"215353401790119557842054580333880151458",
"274858323439496321889267435296779444944",
"245789429505172758703916825018579785587",
"215476942944667489248699465179379716455",
"299127029378326229344656533318629854904",
"112523351408874232190272767023163918444",
"308819560484716367285777914200762289331",
"254015166745900496756362862017071544865",
"56370731530181509523154633403694197395",
"97614217446518582519325337318855980108",
"26800918742382487293809557237094075798",
"278452137593383677734156677900770567058",
"254760518657760757061551376044374745251",
"311524444728454269983667260141592642015"
],
"threshold": 0.9
},
"id": "CVE-2026-5246-54c04dd4",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "mg_atod",
"file": "src/json.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "98473589217372199762288786176251205173",
"length": 1158.0
},
"id": "CVE-2026-5246-58e78bce",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "mg_tls_recv_cert",
"file": "mongoose.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "32210455910707166939160950749999725372",
"length": 2871.0
},
"id": "CVE-2026-5246-598ff68c",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "mg_match",
"file": "mongoose.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "1106225861595394964441040414951427332",
"length": 1414.0
},
"id": "CVE-2026-5246-5f17633d",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "mg_tls_recv_record",
"file": "mongoose.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "63904093970639459445221502944134231697",
"length": 2376.0
},
"id": "CVE-2026-5246-6356028e",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "mg_aes_gcm_decrypt",
"file": "src/tls_aes128.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "284887395322274163673066262777896413487",
"length": 463.0
},
"id": "CVE-2026-5246-637dc058",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "mg_http_parse_headers",
"file": "mongoose.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "187577387590304492909851653472231242198",
"length": 995.0
},
"id": "CVE-2026-5246-63c29e72",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"file": "src/net_builtin.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"272875052070693849567175882970796503685",
"174941304266970034908803404708417986504",
"325515677634887295009015740223415991206",
"240725051084142377963379210491230460651",
"47544155738714589444398018000181882915",
"151565062581388220393578371932084491774",
"176098472037468993123272496858262969410",
"108346869045048453734231298880138200202",
"189129425145615302855593228033943661238",
"284962362096635507392671394059090607698",
"240167769881959622628575733234518246276",
"283820486452260436020555651767874538701",
"210657630259912825272204683103627078739",
"81748695825459609641546607910337680488",
"150839986079736642515317212731311896185",
"147217562461486180854542751445272124903",
"135740491520311850831727720038686505364",
"330930823638739834615971735556405304892",
"90808821232669300321627953952310089261",
"297100237347864914058579389636219061668",
"185558195117700871259561021492392876903",
"138945797621036858455502679664416451494",
"295859711013190854541264736561792026554",
"186946175742719696572222920641736691621",
"80563253276249374257502444141571543685",
"268898602923381710079666002836502702604",
"54008277736932128131107790654075355512",
"46446964086344257330151622362710422138",
"294088950994057299953349670765794449815",
"277815336795832074581049057704211114881"
],
"threshold": 0.9
},
"id": "CVE-2026-5246-69b0c7ea",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "mg_tls_verify_cert_signature",
"file": "src/tls_builtin.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "287623028034891712639184224292359152562",
"length": 1609.0
},
"id": "CVE-2026-5246-7f4a98cf",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "handle_mdns_query",
"file": "mongoose.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "234094490269337275516703077143475779957",
"length": 4366.0
},
"id": "CVE-2026-5246-859b9d67",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "mg_tls_verify_cert_signature",
"file": "mongoose.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "287623028034891712639184224292359152562",
"length": 1609.0
},
"id": "CVE-2026-5246-86621c5d",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "http_cb",
"file": "src/http.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "136434909164675821244055820884942362870",
"length": 3203.0
},
"id": "CVE-2026-5246-87f25262",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"file": "src/tls_chacha20.h"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"280855450986332431349085604423316739658",
"122190681113740699764637444879838689335",
"165051664506154873312422487797586602076",
"15281729727765618144000334521435940646"
],
"threshold": 0.9
},
"id": "CVE-2026-5246-8d532ee5",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "test_json",
"file": "test/unit_test.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "265107008410084495864201209337354819365",
"length": 9598.0
},
"id": "CVE-2026-5246-8ecd5dba",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "handle_opt",
"file": "mongoose.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "102027882861119357625942818285383242107",
"length": 561.0
},
"id": "CVE-2026-5246-90ad0c61",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"file": "src/tls_aes128.h"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"207974650526094451157021192520569915708",
"323347896560934645970690655083833005015"
],
"threshold": 0.9
},
"id": "CVE-2026-5246-94fe542e",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "http_cb",
"file": "mongoose.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "136434909164675821244055820884942362870",
"length": 3203.0
},
"id": "CVE-2026-5246-98f676c9",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "mg_http_parse_headers",
"file": "src/http.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "187577387590304492909851653472231242198",
"length": 995.0
},
"id": "CVE-2026-5246-9f8a2fa3",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"file": "src/dns.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"56933431865281245213749287497782426521",
"303455783710560512343753439937641764898",
"303036824976635134908619449919295352721",
"124624454585074621904655830844712295340",
"6561407956898520786756777653896360563",
"294767461588999872490539531261252552715",
"23097913862147064676774561498425477377",
"306523893688106675536856035552690638391",
"243495406190095439628900850650457985285",
"317946814191474380836591343945907763614",
"314613284483198612553273371780820677253",
"49245216544456347606491959242059417274",
"116778585826418716170303821370250569511",
"336779140437804735905696204924253960839",
"288742116191864459027792656216763133013",
"274327277407508615029546726014812101136",
"332434401912874281430537741122661571567",
"96682559737486944154620655856227149850",
"186622395465038987129288798280409578170",
"310262615795520725550552141501401027813",
"90140572750714774861170194468280871621",
"9244300532616723394411416325184703516",
"19421017225838431121908650094444156603",
"324506443357838879115357657624328182267",
"264065705563480245840999412235584828772",
"26704613209502569353250967690759012161",
"225562100587811317871462542191747469555",
"67985329392020918420900606674817271804",
"97004733065197985112623089887963163096",
"259882351367768646477379968160817102341",
"143842239969820188343810213868778165631",
"73076231494370559425061270848247044790",
"19712610702678678138750778101373063399",
"2051417963277628477041207900031468320",
"193448156027838352693970725127156933391",
"67789153380471409382296741380926711709",
"116982958919005443406061642463119178464",
"28665900490105171143675497991351535105",
"325619045586590384971353053271400495031",
"322203366176116302694913581834816233959",
"144906567610331951298645834025178090357",
"275665191346582512226813004861224494875"
],
"threshold": 0.9
},
"id": "CVE-2026-5246-9fd54074",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "mg_http_parse",
"file": "src/http.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "169482835391483632511920415400433157767",
"length": 2650.0
},
"id": "CVE-2026-5246-a000cf20",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "test_http_parse",
"file": "test/unit_test.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "96597121965754134514680542877790556858",
"length": 8574.0
},
"id": "CVE-2026-5246-acb7a5f1",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "test_match",
"file": "test/unit_test.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "221798542524307238494815944612857726953",
"length": 5807.0
},
"id": "CVE-2026-5246-ad404643",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "mg_tls_recv_cert",
"file": "src/tls_builtin.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "32210455910707166939160950749999725372",
"length": 2871.0
},
"id": "CVE-2026-5246-ade72e58",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"file": "mongoose.h"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"207974650526094451157021192520569915708",
"323347896560934645970690655083833005015",
"281221804496464306984686811210240126495",
"36809931901419678819901745737242605307",
"280855450986332431349085604423316739658",
"122190681113740699764637444879838689335",
"165051664506154873312422487797586602076",
"15281729727765618144000334521435940646"
],
"threshold": 0.9
},
"id": "CVE-2026-5246-af182062",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "mg_atod",
"file": "mongoose.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "98473589217372199762288786176251205173",
"length": 1158.0
},
"id": "CVE-2026-5246-be9c54da",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"file": "src/tls_chacha20.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"86671909889508757942757906751299464277",
"288685814597346261261024784673007913377",
"208540302627622567701609919381829610627",
"308973565140169985853590614608832626669",
"340177776924663054721258530754734619376",
"141898069335864065341824762355327147084",
"163478267167680265790633447886385166179",
"172266484631433410678996138377744150275",
"288408347785360325098529331447392584828",
"299804082750032730164740057256852684493",
"317889136142439194457672805800554329256",
"11198144294321269404455436663924387432",
"188406693863049931447102968283248071383",
"82640399190652379891482606387304947109",
"261467906350646052955097477097071774313",
"224579684604879701433326967871115585145",
"218738675711252010320321931948940263807",
"267399372645606655407081159165455612008",
"306669156786746193942396316066334355421",
"148075135791548817664381439903438766335",
"293665662732071792121171071094380571570",
"295230499844304224415280077334956472484",
"212486963107155032308919581914730950630",
"80979985351413094348471070095489128866",
"330462188675994544967312945304748867699",
"179557291430156444174196948696794994927",
"23408693580845899365845328933754551603",
"219548503678408471025861847291671100948",
"295230499844304224415280077334956472484",
"238514820134418407276834849572934856498",
"120151478661977389860112505950148286347",
"126637918579228009693165287988171011937",
"329940228525569355667064047676155503160",
"138964223778760859751683698195611113395",
"109697911010499671605364282942207118731",
"286718235630277074047459233258413272978",
"128196217974659585650278628768051761342",
"58193428203198968228937992105361911181",
"168835970645394128340244412430549740145",
"148448165703134266156797568887494611204",
"111699303742315830928980711537758271661",
"274994703168481489445931894695666404524",
"42320537998981901654273763762274420190",
"251553503147214024625448007237643122058",
"227786675809996272858477768582552330852",
"141678746247591748580920649705550734869",
"188842102269008906478609187553341740047",
"125171629189675101503180477527288853850",
"258831572389871075508268819855872135361",
"67502928094642593500731059722146586324",
"265734769265306628708510081328851984075",
"241265352231720069307040971674185507195",
"157263359436730301174576694286622566290"
],
"threshold": 0.9
},
"id": "CVE-2026-5246-d2786e11",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "mg_match",
"file": "src/str.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "1106225861595394964441040414951427332",
"length": 1414.0
},
"id": "CVE-2026-5246-dc185e68",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"file": "src/tls_builtin.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"line_hashes": [
"339994179691324067704548755171150621086",
"292816727867213137241220607084019249881",
"115163519840789643773573514817908554262",
"52656032325957364131554071512861025468",
"168726446307564999387028906064870247981",
"164393121173833428582681818186604154089",
"128840611111896029413418295319592257290",
"117919650635928773786702254063542722384",
"331748457844263975774843423516844136484",
"10299790149863837467398885079323728634",
"133031934407816907640259478827773757363",
"127727766903060323082876207448424436262",
"332627427076818448656501346353500451857",
"197271039286460923839245118406935146943",
"280530562517149823643776051246068845765",
"232121593093810813270917944440099007756",
"146050256032827791610710580688900516071",
"329505966588041481371488711060843801039",
"139943472294742398921276591779247270454",
"211630267777897024369314983351812191669",
"143121139624474137479755660008422789602",
"278545133255467574925410929694638865755",
"34493112195234884334933821281064781200",
"148610498549762889717004973256217423141",
"113651584397507884552203427338154868104",
"249469841276797515693095052882972063250",
"227981912956658099610886095835513324290",
"4013314329601652871938402301567531850",
"127688218017202541856626972076064578951",
"268448129425082683312835155095326730006",
"278675231599958880132844965898593265451",
"145391048498550237254294328942577741054",
"175785920547605025903083673681931507177",
"112887602175785218215727790862607116977",
"211501764689793163843921429535111953433",
"56192890385092876449122461616572299313",
"180166381661433559618913587768413906166"
],
"threshold": 0.9
},
"id": "CVE-2026-5246-e7b4a2fe",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "mg_chacha20_poly1305_decrypt",
"file": "src/tls_chacha20.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "214187038073003652483917653332949765372",
"length": 359.0
},
"id": "CVE-2026-5246-e910175b",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
},
{
"target": {
"function": "rx_tcp",
"file": "mongoose.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"function_hash": "4701345775393380708352978062411143252",
"length": 2644.0
},
"id": "CVE-2026-5246-f8e1d0a2",
"source": "https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"
}
]
"2026-07-15T22:57:33Z"
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5246.json"