CVE-2026-6985

Katalog CVE

CVSS 7.5 · High EPSS 0,92%

Kerentanan Improper Resource Shutdown or Release pada cesanta mongoose. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A weakness has been identified in Cesanta Mongoose up to 7.20. This vulnerability affects the function handle_opt of the file /src/net_builtin.c of the component TCP Option Handler. This manipulation of the argument optlen causes infinite loop. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 7.21 is able to resolve this issue. Upgrading the affected component is advised. VulDB has contacted the vendor early and they confirmed quickly, that this issue got fixed already.

Rincian

Terbit di NVD

25 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-404: Improper Resource Shutdown or Release
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

EPSS (30 hari)

0,92% peluang dieksploitasi; lebih tinggi dari 59,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/dwBruijn/CVEs/blob/main/Mongoose/TCP_opt_dos.md exploit · advisory pihak ketiga
• https://vuldb.com/submit/796230 advisory pihak ketiga · vdb entry
• https://vuldb.com/vuln/359528 advisory pihak ketiga · vdb entry
• https://github.com/cesanta/mongoose/releases/tag/7.21 product · release notes
• https://vuldb.com/vuln/359528/cti permissions required · vdb entry