CVE-2026-63626: Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6)
Mongoose is an embedded web server and network library. Prior to 7.23, ppphandleipv6cp() in src/l2ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MGENABLETCPIP and MGENABLEIPV6, an unauthenticated adjacent peer can complete the required LCP exchange and send a short Configure-Request with an oversized length, causing ppptxframe() to read beyond recvqueue.buf and write beyond tx.buf. The same length misuse can also expose adjacent heap bytes in a reply or hang the event loop through findopt(). This issue is fixed in version 7.23.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mongooseto a version that resolves this vulnerability.Fixed in 7.23
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Mongoose before version 7.23 are exposed when PPP or PPPoE is in use and both MG_ENABLE_TCPIP and MG_ENABLE_IPV6 are enabled. The attacker must be an adjacent peer on the PPP or PPPoE link.
Does exploitation require credentials or user interaction?
No. An unauthenticated adjacent peer can exploit the issue after completing the required LCP exchange; no user interaction is required.
What impact could exploitation have?
A crafted IPv6CP Configure-Request can cause an out-of-bounds read from the receive buffer and a heap overflow into the transmit buffer. It may also disclose adjacent heap bytes in a reply or hang the event loop through find_opt().
What is the remediation?
Upgrade Mongoose to version 7.23, which fixes the issue. The provided data does not identify a workaround for systems that cannot be upgraded immediately.