The vulnerability resides in the handle_opt function of the TCP Option Handler within Cesanta Mongoose and is triggered by manipulating the optlen argument. This causes an infinite loop, effectively exhausting CPU or system resources and leading to a denial of service. The flaw is classified under CWE-404 and CWE-835, reflecting improper resource handling and the presence of an infinite loop. The impact is that an attacker can remotely trigger the loop and render the affected component or system unresponsive, potentially affecting availability for users relying on the service.

Products affected are Cesanta Mongoose, version 7.20 and earlier. The problem was identified in releases up to 7.20. Upgrading to version 7.21 patches the flaw and is the recommended action. No other vendors or products are listed as impacted.

The CVSS score of 6.9 indicates a moderate severity, and the EPSS score of below 1% reflects a very low probability of exploitation at any given time. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote; the defect is exposed through network traffic processed by the TCP Option Handler, meaning an attacker does not need local privileges. Although the exploitation code is publicly available, the low EPSS suggests few real‐world incidents to date, but the remote nature and denial-of-service impact still warrant remediation.