CVE-2023-34188: High severity Cesanta Mongoose vulnerability
The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-34188?
CVE-2023-34188 is a vulnerability in the HTTP server in Mongoose before version 7.10 that allows attackers to cause an infinite loop by sending requests with negative Content-Length headers.
What is the severity of CVE-2023-34188?
CVE-2023-34188 has a severity rating of 7.5 (High).
How does CVE-2023-34188 affect Cesanta Mongoose?
CVE-2023-34188 affects Cesanta Mongoose versions up to and excluding 7.10.
How do I fix CVE-2023-34188?
To fix CVE-2023-34188, you should update Cesanta Mongoose to version 7.10 or later.
Where can I find more information about CVE-2023-34188?
You can find more information about CVE-2023-34188 in the following references: [Reference 1](https://blog.narfindustries.com/blog/narf-discovers-critical-vulnerabilities-in-cesanta-mongoose-http-server), [Reference 2](https://github.com/cesanta/mongoose/commit/4663090a8fb036146dfe77718cff612b0101cb0f), [Reference 3](https://github.com/cesanta/mongoose/compare/7.9...7.10).