← Back

Cesanta

cesanta

144 CVEs • 5 products

Products (5)

Click to collapse
Toggle

CVEs (144)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
1Cesanta
1Mongoose
Jun 17, 2026
Nov 18, 2024
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.
1Cesanta
1Mongoose
Jun 17, 2026
Nov 18, 2024
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.
1Cesanta
1Mongoose
Jun 17, 2026
Nov 18, 2024
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.
1Cesanta
1Mongoose
Jun 17, 2026
Nov 18, 2024
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.
1Cesanta
1Mongoose
Sep 8, 2026
Nov 18, 2024
N/A· v4
7.5 HIGH· v3
N/A· v2
Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentation fault on the application.
1Cesanta
1Mongoose
Sep 8, 2026
Nov 18, 2024
N/A· v4
7.0 HIGH· v3
N/A· v2
Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an out-of-bound memory write if the PEM certificate contains unexpected characters.
1Cesanta
1Mongoose
Sep 8, 2026
Nov 18, 2024
N/A· v4
7.5 HIGH· v3
N/A· v2
Integer Overflow or Wraparound vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentation fault on the application.
1Cesanta
1Mongoose
Jun 17, 2026
Nov 18, 2024
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows to write a NULL byte value beyond the memory space dedicated for the hostname field.
1Cesanta
1Mjs
Jun 17, 2026
May 21, 2024
N/A· v4
7.5 HIGH· v3
N/A· v2
An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_do_gc function in the mjs.c file.
1Cesanta
1Mjs
Jun 17, 2026
May 21, 2024
N/A· v4
4.3 MEDIUM· v3
N/A· v2
An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_mk_ffi_sig function in the mjs.c file.
1Cesanta
1Mjs
Jun 17, 2026
May 21, 2024
N/A· v4
5.5 MEDIUM· v3
N/A· v2
An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_array_length function in the mjs.c file.
1Cesanta
1Mjs
Jun 17, 2026
Jan 2, 2024
N/A· v4
7.5 HIGH· v3
N/A· v2
An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_destroy function in the msj.c file.
1Cesanta
1Mjs
Jun 17, 2026
Jan 2, 2024
N/A· v4
7.5 HIGH· v3
N/A· v2
An Out of Bounds Write in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_stringify function in the msj.c file.
1Cesanta
1Mjs
Jun 17, 2026
Jan 2, 2024
N/A· v4
7.5 HIGH· v3
N/A· v2
An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_parse function in the msj.c file.
1Cesanta
1Mjs
Jun 17, 2026
Jan 2, 2024
N/A· v4
7.5 HIGH· v3
N/A· v2
An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs+0x4ec508 component.
1Cesanta
1Mjs
Jun 17, 2026
Jan 2, 2024
N/A· v4
7.5 HIGH· v3
N/A· v2
An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_getretvalpos function in the msj.c file.
1Cesanta
1Mjs
Jun 17, 2026
Dec 20, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Cesanta MJS 2.20.0 has a getprop_builtin_foreign out-of-bounds read if a Built-in API name occurs in a substring of an input string.
1Cesanta
1Mjs
Jun 17, 2026
Sep 23, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the function mjs_get_ptr(). This vulnerability allows attackers to execute arbitrary code via a crafted input.
1Cesanta
1Mongoose
Jun 17, 2026
Aug 22, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Buffer overflow in mg_resolve_from_hosts_file in Mongoose 6.18, when reading from a crafted hosts file.
1Cesanta
1Mongoose
Jun 17, 2026
Aug 9, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web server, version 7.10 is susceptible to a heap-based buffer overfl...Show more
Due to a failure in validating the length of a provided MQTT_CMD_PUBLISH parsed message with a variable length header, Cesanta Mongoose, an embeddable web server, version 7.10 is susceptible to a heap-based buffer overflow vulnerability in the default configuration. Version 7.9 and prior does not appear to be vulnerable. This issue is resolved in version 7.11. Show less