CVE-2023-34188

Summary

The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/cesanta/mongoose/commit/4663090a8fb036146dfe77718cff612b0101cb0f
• https://github.com/cesanta/mongoose/pull/2197
• https://github.com/cesanta/mongoose/compare/7.9…7.10
• https://blog.narfindustries.com/blog/narf-discovers-critical-vulnerabilities-in-cesanta-mongoose-http-server
• https://security.netapp.com/advisory/ntap-20250228-0001/

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: partial

References

• https://github.com/cesanta/mongoose/commit/4663090a8fb036146dfe77718cff612b0101cb0f
• https://github.com/cesanta/mongoose/pull/2197
• https://github.com/cesanta/mongoose/compare/7.9…7.10
• https://blog.narfindustries.com/blog/narf-discovers-critical-vulnerabilities-in-cesanta-mongoose-http-server

• ←Previous
• Next→