A buffer underflow in Mongoose’s TLS DER parser allows a peer‑controlled length field to cause the parser to read beyond the bounds of the certificate buffer, producing an out‑of‑bounds read and potentially crashing the TLS handshake. The flaw is a classic out‑of‑bounds read (CWE‑125) that can lead to a denial of service when the server processes a malformed certificate during the handshake.

The issue impacts every Cesanta Mongoose embedded web server and network library release older than version 7.23. The vulnerability is triggered when an unauthenticated TLS server sends a malformed certificate, or when a client presents a malicious certificate to a server that is configured to require client certificates. Both scenarios can be observed in typical IoT or embedded environments that rely on Mongoose for secure communication.

The vulnerability carries a CVSS score of 7.5, qualifying it as high severity. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog. Attackers can trigger the flaw simply by acting as a malicious TLS peer; authentication is not required. Because the failure occurs during the TLS handshake, the impact manifests as a denial of service, potentially disrupting all traffic to the affected server until the connection is reset or the server is restarted.