CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2025-23061
https://notcve.org/view.php?id=CVE-2025-23061
15 Jan 2025 — Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900. • https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2020-25887
https://notcve.org/view.php?id=CVE-2020-25887
22 Aug 2023 — Buffer overflow in mg_resolve_from_hosts_file in Mongoose 6.18, when reading from a crafted hosts file. Desbordamiento del búfer en mg_resolve_from_hosts_file en Mongoose 6.18, cuando se lee de un archivo hosts manipulado. • https://github.com/cesanta/mongoose/issues/1140 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 1CVE-2023-3696 – Prototype Pollution in automattic/mongoose
https://notcve.org/view.php?id=CVE-2023-3696
17 Jul 2023 — Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4. • https://github.com/automattic/mongoose/commit/305ce4ff789261df7e3f6e72363d0703e025f80d • CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-34188
https://notcve.org/view.php?id=CVE-2023-34188
23 Jun 2023 — The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests. • https://blog.narfindustries.com/blog/narf-discovers-critical-vulnerabilities-in-cesanta-mongoose-http-server • CWE-1284: Improper Validation of Specified Quantity in Input •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-25299 – Arbitrary File Write
https://notcve.org/view.php?id=CVE-2022-25299
18 Feb 2022 — This affects the package cesanta/mongoose before 7.6. The unsafe handling of file names during upload using mg_http_upload() method may enable attackers to write files to arbitrary locations outside the designated target folder. Esto afecta al paquete cesanta/mongoose versiones anteriores a 7.6. Un manejo no seguro de los nombres de archivo durante la carga usando el método mg_http_upload() puede permitir a atacantes escribir archivos en ubicaciones arbitrarias fuera de la carpeta de destino designada • https://github.com/cesanta/mongoose/commit/c65c8fdaaa257e0487ab0aaae9e8f6b439335945 • CWE-552: Files or Directories Accessible to External Parties •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 1CVE-2021-26529
https://notcve.org/view.php?id=CVE-2021-26529
08 Feb 2021 — The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable to remote OOB write attack via connection request after exhausting memory pool. La función mg_tls_init en el servidor Cesanta Mongoose HTTPS versión 7.0 y 6.7-6.18 (compilado con soporte mbedTLS) es vulnerable a un ataque de escritura OOB remota por medio de una petición de conexión después de agotar el grupo de memoria • https://github.com/cesanta/mongoose/issues/1203 • CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2020-25756
https://notcve.org/view.php?id=CVE-2020-25756
18 Sep 2020 — A buffer overflow vulnerability exists in the mg_get_http_header function in Cesanta Mongoose 6.18 due to a lack of bounds checking. A crafted HTTP header can exploit this bug. NOTE: a committer has stated "this will not happen in practice. ** EN DISPUTA ** Una vulnerabilidad de desbordamiento del búfer se presenta en la función mg_get_http_header en Cesanta Mongoose versión 6.18, debido a una falta de comprobación de límites. Un encabezado HTTP diseñado puede explotar este bug. NOTA: un confirmad... • https://github.com/cesanta/mongoose/issues/1135 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 9.8EPSS: 3%CPEs: 1EXPL: 1CVE-2019-19307
https://notcve.org/view.php?id=CVE-2019-19307
26 Nov 2019 — An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infinite loop), or possibly cause an out-of-bounds write, by sending a crafted MQTT protocol packet. Un desbordamiento de enteros en la función parse_mqtt en el archivo mongoose.c en Cesanta Mongoose versión 6.16, permite a un atacante lograr una DoS remota (bucle infinito), o posiblemente causar una escritura fuera de límites, al enviar un paquete de protocolo MQTT diseñado. • https://github.com/cesanta/mongoose/issues/1055 • CWE-125: Out-of-bounds Read CWE-190: Integer Overflow or Wraparound CWE-787: Out-of-bounds Write CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-13503
https://notcve.org/view.php?id=CVE-2019-13503
11 Jul 2019 — mq_parse_http in mongoose.c in Mongoose 6.15 has a heap-based buffer over-read. La función mq_parse_http en el archivo mongoose.c en Mongoose versión 6.15, presenta una lectura en exceso del búfer en la región heap de la memoria. • https://fuzzit.dev/2019/07/11/discovering-cve-2019-13504-cve-2019-13503-and-the-importance-of-api-fuzzing • CWE-125: Out-of-bounds Read •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-12951
https://notcve.org/view.php?id=CVE-2019-12951
24 Jun 2019 — An issue was discovered in Mongoose before 6.15. The parse_mqtt() function in mg_mqtt.c has a critical heap-based buffer overflow. Se detectó un problema en Mongoose anterior a versión 6.15. La función parse_mqtt() en el archivo mg_mqtt.c, presenta un desbordamiento de búfer en la región heap de la memoria crítico. • https://github.com/cesanta/mongoose/commit/b3e0f780c34cea88f057a62213c012aa88fe2deb • CWE-787: Out-of-bounds Write •