CVE-2026-11404: Cesanta Mongoose Out-of-Bounds Read in MG_TLS_BUILTIN ClientHello Session ID Parsing
Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function mgtlsserverrecvhello(), which uses an attacker-controlled sessionidlen byte from a TLS ClientHello as a buffer index without validating it against the length of received data. A remote, unauthenticated attacker can send a single crafted ClientHello with an oversized session id length to read past the receive buffer, crashing any HTTPS, MQTTS, or WSS service built on MGTLSBUILTIN.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11404?
The severity of CVE-2026-11404 is rated as high with a score of 7.5.
How do I fix CVE-2026-11404?
To fix CVE-2026-11404, update Cesanta Mongoose to version 7.22 or later.
What type of vulnerability is CVE-2026-11404?
CVE-2026-11404 is classified as an out-of-bounds read vulnerability in the TLS server function.
What software is affected by CVE-2026-11404?
CVE-2026-11404 affects versions of Cesanta Mongoose prior to version 7.22.
Can CVE-2026-11404 be exploited remotely?
Yes, CVE-2026-11404 can be exploited remotely as it involves an attacker-controlled input.