CVE-2026-5246— Cesanta Mongoose 安全漏洞

Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization

A vulnerability was determined in Cesanta Mongoose up to 7.20. Affected is the function mg_tls_verify_cert_signature of the file mongoose.c of the component P-384 Public Key Handler. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. Attacks of this nature are highly complex. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 7.21 is able to address this issue. This patch is called 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

通过用户控制密钥绕过授权机制

Cesanta Mongoose 安全漏洞

Cesanta Mongoose是爱尔兰Cesanta公司的一套嵌入式服务器库，它包括TCP、HTTP客户端和服务器、WenSocket客户端和服务器等功能。 Cesanta Mongoose 7.20及之前版本存在安全漏洞，该漏洞源于P-384 Public Key Handler组件mongoose.c文件中mg_tls_verify_cert_signature函数的操作可能导致授权绕过，可能导致远程攻击。

N/A

N/A