CVE-2026-6986

A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This issue affects the function mgaesgcmdecrypt of the file /src/tlsaes128.c of the component GCM Authentication Tag Handler. Such manipulation leads to improper verification of cryptographic signature. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 7.21 is capable of addressing this issue. It is advisable to upgrade the affected component. VulDB has contacted the vendor early and they confirmed quickly, that this issue got fixed already.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6986.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-345",
        "CWE-347"
    ]
}

References

Affected packages

Git / github.com/cesanta/mongoose

Affected ranges

Type

GIT

Repo

https://github.com/cesanta/mongoose

Events

Introduced

54250f5fbfa1972b96ef593b457abd6184ea65a0

Fixed

b1c2ffe1a0aa13e3d94075b1a2c66b8b43ac9116

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:cesanta:mongoose:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "7.0"
        },
        {
            "last_affected": "7.0"
        },
        {
            "introduced": "7.1"
        },
        {
            "last_affected": "7.1"
        },
        {
            "introduced": "7.2"
        },
        {
            "last_affected": "7.2"
        },
        {
            "introduced": "7.3"
        },
        {
            "last_affected": "7.3"
        },
        {
            "introduced": "7.4"
        },
        {
            "last_affected": "7.4"
        },
        {
            "introduced": "7.5"
        },
        {
            "last_affected": "7.5"
        },
        {
            "introduced": "7.6"
        },
        {
            "last_affected": "7.6"
        },
        {
            "introduced": "7.7"
        },
        {
            "last_affected": "7.7"
        },
        {
            "introduced": "7.8"
        },
        {
            "last_affected": "7.8"
        },
        {
            "introduced": "7.9"
        },
        {
            "last_affected": "7.9"
        },
        {
            "introduced": "7.10"
        },
        {
            "last_affected": "7.10"
        },
        {
            "introduced": "7.11"
        },
        {
            "last_affected": "7.11"
        },
        {
            "introduced": "7.12"
        },
        {
            "last_affected": "7.12"
        },
        {
            "introduced": "7.13"
        },
        {
            "last_affected": "7.13"
        },
        {
            "introduced": "7.14"
        },
        {
            "last_affected": "7.14"
        },
        {
            "introduced": "7.15"
        },
        {
            "last_affected": "7.15"
        },
        {
            "introduced": "7.16"
        },
        {
            "last_affected": "7.16"
        },
        {
            "introduced": "7.17"
        },
        {
            "last_affected": "7.17"
        },
        {
            "introduced": "7.18"
        },
        {
            "last_affected": "7.18"
        },
        {
            "introduced": "7.19"
        },
        {
            "last_affected": "7.19"
        },
        {
            "introduced": "7.20"
        },
        {
            "last_affected": "7.20"
        },
        {
            "fixed": "7.21"
        }
    ]
}

Affected versions

7.*

7.0

7.1

7.10

7.11

7.12

7.13

7.14

7.15

7.16

7.17

7.18

7.19

7.2

7.20

7.3

7.4

7.5

7.6

7.7

7.8

7.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6986.json"