JLSEC-2026-367

See a problem?
Please try reporting it to the source first.

Source

https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-367.md

Import Source

https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-367.json

JSON Data

https://api.osv.dev/v1/vulns/JLSEC-2026-367

Upstream

CVE-2026-2967

EUVD-2026-7603

GHSA-c6h3-vh8h-r8mj

Published

2026-04-30T19:30:31.295Z

Modified

2026-04-30T20:02:32.616775485Z

Severity

2.9 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This affects the...

Details

A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This affects the function getpeer of the file /src/net_builtin.c of the component TCP Sequence Number Handler. The manipulation leads to improper verification of source of a communication channel. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific

{
    "license": "CC-BY-4.0",
    "sources": [
        {
            "imported": "2026-04-30T18:54:47.672Z",
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2967",
            "database_specific": {
                "status": "Analyzed"
            },
            "id": "CVE-2026-2967",
            "published": "2026-02-23T04:16:02.040Z",
            "modified": "2026-04-29T01:00:01.613Z",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-2967"
        },
        {
            "html_url": "https://github.com/advisories/GHSA-c6h3-vh8h-r8mj",
            "modified": "2026-02-23T06:30:24Z",
            "imported": "2026-04-30T18:55:42.338Z",
            "published": "2026-02-23T06:30:18Z",
            "id": "GHSA-c6h3-vh8h-r8mj",
            "url": "https://api.github.com/advisories/GHSA-c6h3-vh8h-r8mj"
        },
        {
            "html_url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-7603",
            "modified": "2026-02-23T13:32:57Z",
            "id": "EUVD-2026-7603",
            "published": "2026-02-23T02:32:07Z",
            "imported": "2026-04-30T18:55:07.580Z",
            "url": "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2026-7603"
        }
    ]
}

References

Affected packages

Julia / Mongoose_jll

Package

Name: Mongoose_jll
Purl: pkg:julia/Mongoose_jll?uuid=0a8a3f5b-4c0e-5906-8e29-5b3fee15539c

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

7.21.0+0

Database specific

source

"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-367.json"