CVE-2020-25756

CRITICAL 9.8CVE-2020-25756 · Published 18/09/2020 · updated 17/06/2026

In short

CVE-2020-25756 is a CRITICAL (CVSS 9.8) vulnerability affecting mongoose (cesanta).
Chance of exploitation in the next 30 days (EPSS): 1.6%, higher than 76.0% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
mongoose cesanta	`= 6.18`	No fix yet

Description

A buffer overflow vulnerability exists in the mg_get_http_header function in Cesanta Mongoose 6.18 due to a lack of bounds checking. A crafted HTTP header can exploit this bug. NOTE: a committer has stated "this will not happen in practice.

References

cesanta/mongoose · Issue Tracking

More vulnerabilities in mongoose

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

mongoose

cesanta

= 6.18

No fix yet

More vulnerabilities in mongoose

See all →