DEBIAN-CVE-2026-2966

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-2966
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-2966.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-2966
Upstream
Published
2026-02-23T03:15:59.373Z
Modified
2026-05-17T23:01:35.195479Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

A weakness has been identified in Cesanta Mongoose up to 7.20. The impacted element is the function mg_sendnsreq of the file /src/dns.c of the component DNS Transaction ID Handler. Executing a manipulation of the argument random can lead to insufficiently random values. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is regarded as difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

References

Affected packages

Debian:11 / swupdate

Package

Name
swupdate
Purl
pkg:deb/debian/swupdate?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2020.*
2020.11-2
2020.11-2+deb11u1
2021.*
2021.04-1
2021.04-1.1
2021.04-2
2021.11-1~bpo10+1
2021.11-1
2022.*
2022.05-1~bpo10+1
2022.05-1
2022.05-2
2022.05+dfsg-1
2022.12+dfsg-1~bpo11+1
2022.12+dfsg-1
2022.12+dfsg-2
2022.12+dfsg-3~bpo11+1
2022.12+dfsg-3
2022.12+dfsg-4~bpo11+1
2022.12+dfsg-4
2023.*
2023.05+dfsg-1
2023.05+dfsg-2~bpo12+1
2023.05+dfsg-2
2023.05+dfsg-3
2023.05+dfsg-4
2023.05+dfsg-5~bpo12+1
2023.05+dfsg-5
2023.12+dfsg-1~bpo12+1
2023.12+dfsg-1
2023.12.1+dfsg-1~bpo12+1
2023.12.1+dfsg-1
2023.12.1+dfsg-2~bpo12+1
2023.12.1+dfsg-2
2024.*
2024.05+dfsg-1
2024.05.2+dfsg-1
2024.05.2+dfsg-2~bpo12+1
2024.05.2+dfsg-2
2024.12+dfsg-1
2024.12+dfsg-2~bpo12+1
2024.12+dfsg-2
2024.12.1+dfsg-1~bpo12+1
2024.12.1+dfsg-1
2024.12.1+dfsg-2
2024.12.1+dfsg-3~bpo12+1
2024.12.1+dfsg-3
2025.*
2025.05+dfsg-1
2025.05+dfsg-2~bpo13+1
2025.05+dfsg-2
2025.05+dfsg-3~bpo13+1
2025.05+dfsg-3
2025.12+dfsg-1
2025.12+dfsg-2~bpo13+1
2025.12+dfsg-2
2025.12+dfsg-3
2025.12+dfsg-4
2025.12+dfsg-5
2025.12+dfsg-6
2025.12+dfsg-7~bpo13+1
2025.12+dfsg-7
2025.12+dfsg-8
2025.12+dfsg-9
2025.12+dfsg-10

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-2966.json"

Debian:12 / swupdate

Package

Name
swupdate
Purl
pkg:deb/debian/swupdate?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2022.*
2022.12+dfsg-4
2022.12+dfsg-4+deb12u1~bpo11+1
2022.12+dfsg-4+deb12u1
2022.12+dfsg-4+deb12u2
2023.*
2023.05+dfsg-1
2023.05+dfsg-2~bpo12+1
2023.05+dfsg-2
2023.05+dfsg-3
2023.05+dfsg-4
2023.05+dfsg-5~bpo12+1
2023.05+dfsg-5
2023.12+dfsg-1~bpo12+1
2023.12+dfsg-1
2023.12.1+dfsg-1~bpo12+1
2023.12.1+dfsg-1
2023.12.1+dfsg-2~bpo12+1
2023.12.1+dfsg-2
2024.*
2024.05+dfsg-1
2024.05.2+dfsg-1
2024.05.2+dfsg-2~bpo12+1
2024.05.2+dfsg-2
2024.12+dfsg-1
2024.12+dfsg-2~bpo12+1
2024.12+dfsg-2
2024.12.1+dfsg-1~bpo12+1
2024.12.1+dfsg-1
2024.12.1+dfsg-2
2024.12.1+dfsg-3~bpo12+1
2024.12.1+dfsg-3
2025.*
2025.05+dfsg-1
2025.05+dfsg-2~bpo13+1
2025.05+dfsg-2
2025.05+dfsg-3~bpo13+1
2025.05+dfsg-3
2025.12+dfsg-1
2025.12+dfsg-2~bpo13+1
2025.12+dfsg-2
2025.12+dfsg-3
2025.12+dfsg-4
2025.12+dfsg-5
2025.12+dfsg-6
2025.12+dfsg-7~bpo13+1
2025.12+dfsg-7
2025.12+dfsg-8
2025.12+dfsg-9
2025.12+dfsg-10

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-2966.json"

Debian:13 / swupdate

Package

Name
swupdate
Purl
pkg:deb/debian/swupdate?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2024.*
2024.12.1+dfsg-3
2024.12.1+dfsg-3+deb13u1
2024.12.1+dfsg-3+deb13u2
2025.*
2025.05+dfsg-1
2025.05+dfsg-2~bpo13+1
2025.05+dfsg-2
2025.05+dfsg-3~bpo13+1
2025.05+dfsg-3
2025.12+dfsg-1
2025.12+dfsg-2~bpo13+1
2025.12+dfsg-2
2025.12+dfsg-3
2025.12+dfsg-4
2025.12+dfsg-5
2025.12+dfsg-6
2025.12+dfsg-7~bpo13+1
2025.12+dfsg-7
2025.12+dfsg-8
2025.12+dfsg-9
2025.12+dfsg-10

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-2966.json"

Debian:14 / swupdate

Package

Name
swupdate
Purl
pkg:deb/debian/swupdate?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2025.12+dfsg-10

Affected versions

2024.*
2024.12.1+dfsg-3
2025.*
2025.05+dfsg-1
2025.05+dfsg-2~bpo13+1
2025.05+dfsg-2
2025.05+dfsg-3~bpo13+1
2025.05+dfsg-3
2025.12+dfsg-1
2025.12+dfsg-2~bpo13+1
2025.12+dfsg-2
2025.12+dfsg-3
2025.12+dfsg-4
2025.12+dfsg-5
2025.12+dfsg-6
2025.12+dfsg-7~bpo13+1
2025.12+dfsg-7
2025.12+dfsg-8
2025.12+dfsg-9

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-2966.json"