Cesanta Mongoose versions prior to 7.22 contain an out‑of‑bounds read in the built‑in TLS server function mg_tls_server_recv_hello(). The flaw arises when a TLS ClientHello includes a session_id_len byte that is larger than the actual data received; the code uses this value as a buffer index without bounds checking, reading past the allocated receive buffer. This read can cause a crash of the process, effectively denying service for any HTTPS, MQTTS, or WSS endpoint that uses the MG_TLS_BUILTIN implementation.

Applications or services that embed the Cesanta Mongoose library in a version earlier than 7.22 and employ the built‑in TLS server will be affected. This includes web servers, MQTT brokers, or any service exposing WebSocket over TLS, as they rely on mg_tls_server_recv_hello() for the initial handshake.

The CVSS score of 8.7 marks the vulnerability as high severity, and the EPSS score of less than 1% indicates a low probability of exploitation in the wild, though the lack of authentication makes the attack trivial to launch. The vulnerability is not listed in CISA’s KEV catalog. An attacker can send a single crafted ClientHello packet containing an oversized session identifier to trigger the read past the buffer, leading to a crash of the entire service. Because the flaw operates prior to authentication, it is fully remote and unauthenticated.