CVE-2026-11404: Mongoose TLS Out-of-Bounds Read Denial of Service

Technical summary

CVE-2026-11404 is an out-of-bounds read vulnerability in the mg_tls_server_recv_hello() function within Cesanta Mongoose versions prior to 7.22. The flaw stems from insufficient bounds checking on the session_id_len field extracted from an incoming TLS ClientHello message. This attacker-controlled byte is used directly as a buffer index without validation against the actual length of received data, enabling an unauthenticated remote attacker to trigger an out-of-bounds memory access. The vulnerability is classified under CWE-125 (Out-of-bounds Read) and results in denial of service via crash.

Business impact

Organizations relying on Mongoose-based TLS services face unplanned downtime and service unavailability. IoT devices, embedded systems, and edge services commonly use Mongoose; exploitation could disrupt critical infrastructure, manufacturing environments, or real-time communication systems. The attack requires no authentication and is trivial to execute—a single malformed TLS ClientHello is sufficient. While confidentiality and integrity are not compromised, availability impact is severe, especially for mission-critical deployments where service uptime is essential.

Affected systems

Cesanta Mongoose versions before 7.22 are vulnerable when built with MG_TLS_BUILTIN enabled. This includes any application or device embedding Mongoose and offering HTTPS endpoints, MQTTS brokers, or WSS services. Vulnerable deployments span IoT platforms, embedded web interfaces, industrial controllers, smart home devices, and edge gateways. Systems using alternative TLS implementations (OpenSSL, mbedTLS, etc.) configured as Mongoose alternatives are not affected, only those using the native built-in TLS stack.

Exploitability

Exploitability is very high. The attack is network-accessible, requires no authentication, no user interaction, and is straightforward to execute: an attacker simply sends a single crafted TLS ClientHello with an oversized session_id_len field. No complex heap manipulation, race conditions, or brute-force is needed. The barrier to weaponization is low; any attacker with basic TLS protocol knowledge can craft the payload. Scanning and targeting vulnerable endpoints is practical, making opportunistic attacks likely.

Remediation

Upgrade Cesanta Mongoose to version 7.22 or later. This version corrects the bounds checking logic in mg_tls_server_recv_hello() to validate session_id_len against the actual received data length before using it as a buffer index. Organizations should prioritize patching in production environments, especially those where Mongoose services are internet-facing or critical to operations.

Patch guidance

Apply version 7.22 or later of Cesanta Mongoose. Verify compatibility with your application and test in a staging environment before deploying to production. Check Cesanta's official release notes and security advisories for any additional considerations or breaking changes. If you maintain custom builds of Mongoose, ensure your build configuration includes the patched version of mg_tls_server_recv_hello(). For embedded or firmware-based deployments, confirm that your device manufacturer or integrator has released a patched image and follow their update procedures.

Detection guidance

Monitor for sudden crashes or restarts of services using Mongoose TLS. Implement robust logging and alerting on process terminations linked to TLS handshake errors. Network-level detection is challenging due to the legitimate-looking ClientHello; focus on telemetry showing repeated TLS connection failures from external sources followed by service crashes. Endpoint Detection and Response (EDR) tools can flag abnormal process termination patterns. Code review and static analysis of Mongoose deployments can identify vulnerable versions before exploitation. Consider network segmentation to limit which external sources can initiate TLS connections to Mongoose services.

Why prioritize this

This vulnerability merits high priority due to its combination of trivial exploitability, severe availability impact, and ubiquitous presence in embedded and IoT ecosystems. Internet-facing Mongoose services should be patched immediately. Even internal deployments warrant prompt remediation because the attack requires no privilege escalation or complex steps, making it attractive to opportunistic attackers. Organizations running legacy firmware or closed-source systems using Mongoose should begin vendor engagement now to obtain patched builds.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible, unauthenticated attack with no user interaction required, resulting in high availability impact (service crash) but no confidentiality or integrity compromise. The score appropriately captures the severity for typical deployments. However, organizations running Mongoose on internet-facing, critical-availability systems may consider this a 'critical' operational priority regardless of the base CVSS, as any denial of service in those contexts carries significant business risk.

Frequently asked questions