Mongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c)

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

Mongoose is an embedded web server and network library. Prior to 7.22, mg_path_is_sane in src/util.c read path.buf[1] without first requiring path.len to be at least two and read s[2] when only two bytes remained. Unauthenticated remote requests reaching mg_http_upload or mg_http_serve_dir with the affected short path shapes could therefore trigger one-byte heap out-of-bounds reads. On bare-metal or RTOS targets without memory protection, the adjacent byte could be exposed or influence whether a path was accepted, and instrumented builds could crash. This issue is fixed in version 7.22.

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…ngoose/security/advisories/GHSA-cjmx-764f-286c Diğer
• github.com/…ommit/b55de8b151d1466a3e41d1f854f22eeb6faa23dc Diğer
• github.com/cesanta/mongoose/releases/tag/7.22 Diğer

Kayıt geçmişi

1. 5 Kas 2026 00:40Yayımlandı

İlgili açıklar

• 8,8 CVE-2026-77372VeraCrypt: Heap overflow and out-of-bounds read in Serializable deserialization (elevated Core service input path)
• 5,3 CVE-2026-19319IBM Watson Speech Services Cartridge is vulnerable to an Out-of-bounds Read in Onnx
• 7,5 CVE-2026-17493IBM Watson Speech Services Cartridge is vulnerable to a D.O.S. in Unpacker.
• 6,1 CVE-2026-121942ZBar through 0.23.95 Out-of-Bounds Read via _zbar_sq_decode() in sqcode.c
• 7,8 CVE-2026-87041Inverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to read and write arbitrary kernel memory
• 5,3 CVE-2026-118237Out-of-bounds read vulnerability in GitHub Enterprise Server allowed disclosure of process memory in the Git service