VulnerabilityModified
CVE-2023-34188
By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests.
HIGH 7.5EPSS 1.01%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.01%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 1.01% probability · 61th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-1284
- Affected
- cesanta/mongoose
- Source
- cve@mitre.org
References
- https://blog.narfindustries.com/blog/narf-discovers-critical-vulnerabilities-in-cesanta-mongoose-http-server
- https://github.com/cesanta/mongoose/commit/4663090a8fb036146dfe77718cff612b0101cb0fPatch
- https://github.com/cesanta/mongoose/compare/7.9...7.10Release Notes
- https://github.com/cesanta/mongoose/pull/2197Patch
- https://blog.narfindustries.com/blog/narf-discovers-critical-vulnerabilities-in-cesanta-mongoose-http-server
- https://github.com/cesanta/mongoose/commit/4663090a8fb036146dfe77718cff612b0101cb0fPatch
- https://github.com/cesanta/mongoose/compare/7.9...7.10Release Notes
- https://github.com/cesanta/mongoose/pull/2197Patch
- https://security.netapp.com/advisory/ntap-20250228-0001/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.