CVE-2026-2967: Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of source
A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This affects the function getpeer of the file /src/netbuiltin.c of the component TCP Sequence Number Handler. The manipulation leads to improper verification of source of a communication channel. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2967?
CVE-2026-2967 is classified as a security vulnerability that may lead to improper verification of the source in the TCP Sequence Number Handler.
How do I fix CVE-2026-2967?
To fix CVE-2026-2967, upgrade Cesanta Mongoose to version 7.21 or later where the vulnerability has been addressed.
Which versions of Cesanta Mongoose are affected by CVE-2026-2967?
CVE-2026-2967 affects Cesanta Mongoose versions up to and including 7.20.
What component is impacted by CVE-2026-2967?
CVE-2026-2967 impacts the TCP Sequence Number Handler within the net_builtin.c file of Cesanta Mongoose.
What type of manipulation does CVE-2026-2967 allow?
CVE-2026-2967 allows for improper verification of data, potentially leading to unauthorized access or exploitation.