https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-73259.htmlhttps://patchthecve.com/cve/CVE-2026-73259.htmlSun, 18 Oct 2026 20:10:00 +0000MEDIUM 5.4: Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MG_ENABLE_DIRLIST and persuade a user to visit it. The mg_http_serve_dir() and listdir() path in src/http.c places the decoded request URI inhttps://patchthecve.com/cve/CVE-2026-73258.htmlhttps://patchthecve.com/cve/CVE-2026-73258.htmlSun, 18 Oct 2026 20:10:00 +0000MEDIUM 6.5: Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mg_http_next_multipart() in src/http.c. The loops comparing s[b] and s[b + 1], and s[h2] and s[h2 + 1], use an incorrect AND conditiohttps://patchthecve.com/cve/CVE-2026-73257.htmlhttps://patchthecve.com/cve/CVE-2026-73257.htmlSun, 18 Oct 2026 20:10:00 +0000CRITICAL 9.1: Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_http_parse() and http_cb() paths in src/http.c accept bohttps://patchthecve.com/cve/CVE-2026-73256.htmlhttps://patchthecve.com/cve/CVE-2026-73256.htmlSun, 18 Oct 2026 20:10:00 +0000CRITICAL 9.1: Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http_cb() function in src/http.c tests hm.proto.len with an impohttps://patchthecve.com/cve/CVE-2026-73255.htmlhttps://patchthecve.com/cve/CVE-2026-73255.htmlSun, 18 Oct 2026 20:10:00 +0000MEDIUM 6.5: Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an #include file or #include virtual directive. The mg_ssi() function in src/ssi.c concatenates the directive argument into a filesystem phttps://patchthecve.com/cve/CVE-2026-73254.htmlhttps://patchthecve.com/cve/CVE-2026-73254.htmlSun, 18 Oct 2026 20:10:00 +0000MEDIUM 5.4: Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MG_ENABLE_DIRLIST. The printdirentry() path called by listdir() in src/http.c https://patchthecve.com/cve/CVE-2026-73253.htmlhttps://patchthecve.com/cve/CVE-2026-73253.htmlSun, 18 Oct 2026 20:10:00 +0000CRITICAL 9.1: Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mg_tls_verify_cert_san() and mg_tls_verify_cert_cn() functions inhttps://patchthecve.com/cve/CVE-2026-73251.htmlhttps://patchthecve.com/cve/CVE-2026-73251.htmlSun, 18 Oct 2026 20:10:00 +0000CRITICAL 9.1: Mongoose is an embedded web server and network library. Prior to 7.23, a network attacker can impersonate a TLS server to a Mongoose client configured with a multi-certificate CA bundle. In src/tls_builtin.c, the mg_tls_init() function stores the bundle in tls->ca_bundle_der while tls->ca_der.len rehttps://patchthecve.com/cve/CVE-2026-6986.htmlhttps://patchthecve.com/cve/CVE-2026-6986.htmlMon, 26 Oct 2026 21:10:00 +0000LOW 3.7: A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This issue affects the function mg_aes_gcm_decrypt of the file /src/tls_aes128.c of the component GCM Authentication Tag Handler. Such manipulation leads to improper verification of cryptographic signature. The attack may be https://patchthecve.com/cve/CVE-2026-6985.htmlhttps://patchthecve.com/cve/CVE-2026-6985.htmlMon, 26 Oct 2026 22:10:00 +0000MEDIUM 5.3: A weakness has been identified in Cesanta Mongoose up to 7.20. This vulnerability affects the function handle_opt of the file /src/net_builtin.c of the component TCP Option Handler. This manipulation of the argument optlen causes infinite loop. The attack is possible to be carried out remotely. The https://patchthecve.com/cve/CVE-2026-5246.htmlhttps://patchthecve.com/cve/CVE-2026-5246.htmlMon, 26 Oct 2026 22:10:00 +0000MEDIUM 5.6: A vulnerability was determined in Cesanta Mongoose up to 7.20. Affected is the function mg_tls_verify_cert_signature of the file mongoose.c of the component P-384 Public Key Handler. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. Attacks of this naturhttps://patchthecve.com/cve/CVE-2026-5245.htmlhttps://patchthecve.com/cve/CVE-2026-5245.htmlMon, 26 Oct 2026 21:10:00 +0000MEDIUM 5.6: A vulnerability was found in Cesanta Mongoose up to 7.20. This impacts the function handle_mdns_record of the file mongoose.c of the component mDNS Record Handler. Performing a manipulation of the argument buf results in stack-based buffer overflow. Remote exploitation of the attack is possible. A hhttps://patchthecve.com/cve/CVE-2026-5244.htmlhttps://patchthecve.com/cve/CVE-2026-5244.htmlMon, 26 Oct 2026 22:10:00 +0000HIGH 7.3: A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mongoose.c of the component TLS 1.3 Handler. Such manipulation of the argument pubkey leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been d