9.8
Critical
CVE-2017-2891 An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8
Description
An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8. An ordinary HTTP POST request with a CGI target can cause a reuse of previously freed pointer potentially resulting in remote code execution. An attacker needs to send this HTTP request over the network to trigger this vulnerability.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Mongoose | 6.8 | No fix stated |
Other CVEs of Mongoose
The 38 CVEs of Mongoose →
CVE-2026-115473
Mongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c)
6.5
Medium
CVE-2026-63626
Mongoose is an embedded web server and network library
8.8
High
CVE-2026-73261
Mongoose is an embedded web server and network library
7.5
High
CVE-2026-73260
Mongoose is an embedded web server and network library
7.5
High