7.5

CVE-2023-34188

The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cesanta ≫ Mongoose Version < 7.10
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.01% 0.585
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-1284 Improper Validation of Specified Quantity in Input

The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

https://blog.narfindustries.com/blog/narf-discovers-critical-vulnerabilities-in-cesanta-mongoose-http-server
https://github.com/cesanta/mongoose/commit/4663090a8fb036146dfe77718cff612b0101cb0f
Patch
https://github.com/cesanta/mongoose/compare/7.9...7.10
Release Notes
https://github.com/cesanta/mongoose/pull/2197
Patch
https://security.netapp.com/advisory/ntap-20250228-0001/