High severity · published Apr 2, 2026
CVE-2026-5245
Cesanta Mongoose mDNS Record mongoose.c handle_mdns_record stack-based overflow
8.1
CVSS
0.7%
EPSS
No
On KEV
Description
A vulnerability was found in Cesanta Mongoose up to 7.20. This impacts the function handle_mdns_record of the file mongoose.c of the component mDNS Record Handler. Performing a manipulation of the argument buf results in stack-based buffer overflow. Remote exploitation of the attack is possible. A high degree of complexity is needed for the attack. The exploitability is said to be difficult. The exploit has been made public and could be used. Upgrading to version 7.21 will fix this issue. The patch is named 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MO
Mongoose · Cesanta
7.0; 7.1; 7.2; 7.3; 7.4; 7.5; +15 more · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-5245
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-5245
Product
https://github.com/cesanta/mongoose/
Patch
https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1
Product
https://github.com/cesanta/mongoose/releases/tag/7.21
Third Party Advisory
https://vuldb.com/submit/770103
Third Party Advisory
https://vuldb.com/vuln/354826
Permissions Required
https://vuldb.com/vuln/354826/cti
More from Mongoose
9.8
CVE-2026-5244
Cesanta Mongoose TLS 1.3 mongoose.c mg_tls_recv_cert heap-based overflow
9.8
CVE-2024-42383
Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows to write a NULL byte value beyond the memory space dedicated for the hostname field
9.8
CVE-2020-25756
A buffer overflow vulnerability exists in the mg_get_http_header function in Cesanta Mongoose 6.18 due to a lack of bounds checking
9.8
CVE-2019-19307
An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infinite loop), or possibly cause an out-of-bounds write, by…
9.8
CVE-2019-12951
An issue was discovered in Mongoose before 6.15