Description
Mongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MG_ENABLE_TCPIP and MG_ENABLE_IPV6, an unauthenticated adjacent peer can complete the required LCP exchange and send a short Configure-Request with an oversized length, causing ppp_tx_frame() to read beyond recv_queue.buf and write beyond tx.buf. The same length misuse can also expose adjacent heap bytes in a reply or hang the event loop through find_opt(). This issue is fixed in version 7.23.
Published: 2026-10-14
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote code execution
Action: Immediate Patch
AI Analysis

Impact

Mongoose, an embedded web server library, contains a flaw in ppp_handle_ipv6cp() where the IPv6CP length field is trusted without bounds verification. This results in out‑of‑bounds reads and heap write operations when an adjacent PPP or PPPoE peer sends an oversized Configure‑Request. The memory corruption can lead to crashes or arbitrary code execution on the device hosting the library.

Affected Systems

The vulnerability affects all cesanta mongoose versions prior to 7.23 that compile with MG_ENABLE_TCPIP and MG_ENABLE_IPV6 flags when operating over PPP or PPPoE links. Systems using these features and not yet updated to 7.23 are vulnerable.

Risk and Exploitability

The CVSS score is 8.8, indicating a high severity. The EPSS score is not published, and the issue is not listed in CISA's KEV catalog, but the lack of a hard bound on the length field allows an unauthenticated adjacent peer to trigger the overflow, potentially compromising confidentiality, integrity, and availability of the host. The attack vector is inferred to be a malicious PPP or PPPoE session established over a local link, requiring no privileged connection beyond normal PPP negotiation.

Generated by OpenCVE AI on October 15, 2026 at 14:04 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update mongoose to version 7.23 or newer, which contains the bounds check fix.
  • If an immediate upgrade is not possible, disable the MG_ENABLE_IPV6 flag or avoid PPP/PPPoE usage until a patch can be applied, limiting the ability of an attacker to send oversized packets.
  • Verify that the transport configuration precludes untrusted peers and monitor for abnormal PPP frames that could indicate attempted exploitation.

Generated by OpenCVE AI on October 15, 2026 at 14:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Cesanta
Cesanta mongoose
Vendors & Products Cesanta
Cesanta mongoose

Sat, 17 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
Description Mongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MG_ENABLE_TCPIP and MG_ENABLE_IPV6, an unauthenticated adjacent peer can complete the required LCP exchange and send a short Configure-Request with an oversized length, causing ppp_tx_frame() to read beyond recv_queue.buf and write beyond tx.buf. The same length misuse can also expose adjacent heap bytes in a reply or hang the event loop through find_opt(). This issue is fixed in version 7.23.
Title Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6)
Weaknesses CWE-122
CWE-125
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Cesanta Mongoose
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-15T15:06:33.386Z

Reserved: 2026-07-17T14:11:15.481Z

Link: CVE-2026-63626

cve-icon Vulnrichment

Updated: 2026-10-15T13:53:23.803Z

cve-icon NVD

Status : Deferred

Published: 2026-10-14T19:17:18.570

Modified: 2026-10-16T20:04:29.760

Link: CVE-2026-63626

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T22:45:13Z

Weaknesses