CVE-2020-25756

Published: Sep 18, 2020Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A buffer overflow vulnerability exists in the mg_get_http_header function in Cesanta Mongoose 6.18 due to a lack of bounds checking. A crafted HTTP header can exploit this bug. NOTE: a committer has stated "this will not happen in practice.

Affected (1)

Products: Cesanta: Mongoose

Cesanta

1 product

Mongoose

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Cesanta Mongoose	Version 6.18

Related CWEs

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References (2)

https://github.com/cesanta/mongoose/issues/1135

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://github.com/cesanta/mongoose/issues/1135

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchThird Party Advisory

Timeline

No history available yet.