← Vulnerability feed

Vulnerability record · CVE-2026-6986 · published 25 April 2026

CVE-2026-6986: Cesanta mongoose insufficient verification of data authenticity vulnerability

Cesanta · Mongoose

A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This issue affects the function mg_aes_gcm_decrypt of the file /src/tls_aes128.c of the component GCM Authentication Tag Handler. Such manipulation leads to improper verification of cryptographic signature. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 7.21 is capable of addressing this issue. It is advisable to upgrade the affected component. VulDB has contacted the vendor early and they confirmed quickly, that this issue got fixed already.

2.9 CVSS 4.0 Low EPSS 0.25% · top 84.6% CWE-345 · Insufficient verification of data authenticityCWE-347 · Improper verification of cryptographic signature
2.9CVSS 4.0 base score, v2 2.6
0.25%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
5References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This issue affects the function mg_aes_gcm_decrypt of the file /src/tls_aes128.c of the component GCM Authentication Tag Handler. Such manipulation leads to improper verification of cryptographic signature. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 7.21 is capable of addressing this issue. It is advisable to upgrade the affected component. VulDB has contacted the vendor early and they confirmed quickly, that this issue got fixed already.

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/cesanta/mongoose/releases/tag/7.21 Release Notes
https://github.com/dwBruijn/CVEs/blob/main/Mongoose/AESGCM.md ExploitThird Party Advisory
https://vuldb.com/submit/796231 Third Party AdvisoryVDB Entry
https://vuldb.com/vuln/359529 Third Party AdvisoryVDB Entry
https://vuldb.com/vuln/359529/cti Permissions RequiredVDB Entry

Track CVE-2026-6986 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-42383Cesanta mongoose vulnerabilityUse of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows to write a NULL byte value beyond the memory space dedic…EPSS 0.27%9.8CVE-2020-25756Cesanta mongoose classic buffer overflow vulnerabilityA buffer overflow vulnerability exists in the mg_get_http_header function in Cesanta Mongoose 6.18 due to a lack of bounds checking. A crafted HTTP h…EPSS 1.6%9.8CVE-2019-19307Cesanta mongoose out-of-bounds read vulnerabilityAn integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infinite loop), or possibly cause …EPSS 42%9.8CVE-2019-12951Cesanta mongoose out-of-bounds write vulnerabilityAn issue was discovered in Mongoose before 6.15. The parse_mqtt() function in mg_mqtt.c has a critical heap-based buffer overflow.EPSS 2.0%9.8CVE-2018-20355Cesanta mongoose use after free vulnerabilityAn invalid write of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in mongoose.c in Cesanta Mongoose …EPSS 3.6%9.8CVE-2018-20353Cesanta mongoose use after free vulnerabilityAn invalid read of 8 bytes due to a use-after-free vulnerability during a "NULL test" in the mg_http_get_proto_data function in mongoose.c in Cesanta…EPSS 3.6%9.8CVE-2018-20356Cesanta mongoose use after free vulnerabilityAn invalid read of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in mongoose.c in Cesanta Mongoose E…EPSS 3.6%9.8CVE-2018-20354Cesanta mongoose use after free vulnerabilityAn invalid read of 8 bytes due to a use-after-free vulnerability during a "return" in the mg_http_get_proto_data function in mongoose.c in Cesanta Mo…EPSS 3.6%

Source: NIST National Vulnerability Database (record CVE-2026-6986), CISA KEV, FIRST EPSS (scores of 2026-10-07). This page is refreshed as NVD updates the record.