CVE-2025-65502: Null Pointer Dereference
Null pointer dereference in addcacerts() in Cesanta Mongoose before 7.2 allows remote attackers to cause a denial of service via TLS initialization where SSLCTXgetcertstore() returns NULL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/swupdateto a version that resolves this vulnerability.Fixed in 2025.12+dfsg-1 - Upgrade
Upgrade
debian/mongooseto a version that resolves this vulnerability.Fixed in 7.23+ds-1 - Upgrade
Upgrade
debian/swupdateto a version that resolves this vulnerability.Fixed in 2026.05.1+git20261001+dfsg-2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-65502?
CVE-2025-65502 is classified as a denial of service vulnerability.
How does CVE-2025-65502 affect the Cesanta Mongoose?
CVE-2025-65502 affects Cesanta Mongoose by allowing remote attackers to trigger a null pointer dereference during TLS initialization.
How do I fix CVE-2025-65502?
To fix CVE-2025-65502, upgrade Cesanta Mongoose to version 7.2 or later.
What versions of Cesanta Mongoose are vulnerable to CVE-2025-65502?
Versions of Cesanta Mongoose prior to 7.2 are vulnerable to CVE-2025-65502.
Can CVE-2025-65502 be exploited remotely?
Yes, CVE-2025-65502 can be exploited remotely by attackers to cause a denial of service.