CVE-2023-34188

Published: Jun 23, 2023Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests.

Affected (1)

Products: Cesanta: Mongoose

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Cesanta Mongoose	Before 7.10

Related CWEs

Improper Validation of Specified Quantity in Input

The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

References (9)

https://blog.narfindustries.com/blog/narf-discovers-critical-vulnerabilities-in-cesanta-mongoose-http-server

Source: cve@mitre.org

https://github.com/cesanta/mongoose/commit/4663090a8fb036146dfe77718cff612b0101cb0f

Source: cve@mitre.org

Patch

https://github.com/cesanta/mongoose/compare/7.9...7.10

Source: cve@mitre.org

Release Notes

https://github.com/cesanta/mongoose/pull/2197

Source: cve@mitre.org

Patch

https://blog.narfindustries.com/blog/narf-discovers-critical-vulnerabilities-in-cesanta-mongoose-http-server

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/cesanta/mongoose/commit/4663090a8fb036146dfe77718cff612b0101cb0f

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/cesanta/mongoose/compare/7.9...7.10

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

https://github.com/cesanta/mongoose/pull/2197

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://security.netapp.com/advisory/ntap-20250228-0001/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.