CVE-2021-26530: Critical severity mongoose os vulnerability

Published Feb 8, 2021

Updated

The mgtlsinit function in Cesanta Mongoose HTTPS server 7.0 (compiled with OpenSSL support) is vulnerable to remote OOB write attack via connection request after exhausting memory pool.

Affected Software

1 affected component

Cesanta Mongoose=7.0

Event History

Feb 8, 2021

CVE Published

via MITRE·08:13 PM

Data Sourced

via MITRE·08:13 PM

Description

Frequently Asked Questions

What is CVE-2021-26530?

CVE-2021-26530 is a vulnerability in the mg_tls_init function of Cesanta Mongoose HTTPS server 7.0 that allows remote OOB write attacks after exhausting the memory pool.

What software is affected by CVE-2021-26530?

The vulnerability affects Cesanta Mongoose HTTPS server 7.0 compiled with OpenSSL support.

What is the severity of CVE-2021-26530?

CVE-2021-26530 has a severity rating of 9.1 out of 10, making it critical.

How can I fix CVE-2021-26530?

To fix CVE-2021-26530, it is recommended to update to a version of Cesanta Mongoose HTTPS server that is not affected by the vulnerability.

Is there any reference available for CVE-2021-26530?

Yes, you can find more information about CVE-2021-26530 at the following reference: https://github.com/cesanta/mongoose/issues/1204