CVE-2026-63626

Deferred Deferred - Pending Action

Memory Corruption in Mongoose Embedded Web Server

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

Mongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MG_ENABLE_TCPIP and MG_ENABLE_IPV6, an unauthenticated adjacent peer can complete the required LCP exchange and send a short Configure-Request with an oversized length, causing ppp_tx_frame() to read beyond recv_queue.buf and write beyond tx.buf. The same length misuse can also expose adjacent heap bytes in a reply or hang the event loop through find_opt(). This issue is fixed in version 7.23.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-63626

EUVD

EUVD-2026-101599

Affected Vendors & Products

Vendor	Product	Version / Range
cesanta	mongoose	< 7.23

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is in Mongoose, an embedded web server and network library. It involves a flaw in the ppp_handle_ipv6cp() function where a 16-bit length field from IPv6CP frames is not properly validated against the actual received payload size. This allows an attacker on the same PPP/PPPoE link to trigger out-of-bounds memory reads and heap overflows by sending maliciously crafted packets.

Detection Guidance

Check if your Mongoose version is below 7.23 by running: mongoose --version or inspecting the library version in your application. Monitor network traffic on PPP/PPPoE links for malformed IPv6CP packets with oversized length fields using packet capture tools like tcpdump or Wireshark.

Impact Analysis

An attacker could exploit this to read sensitive heap memory, corrupt heap structures, or cause a denial-of-service by hanging the event loop. This requires the attacker to be on the same network link as the vulnerable system.

Compliance Impact

This vulnerability primarily affects network communication security in embedded systems using Mongoose. While it does not directly violate GDPR or HIPAA, it could indirectly impact compliance by enabling unauthorized data access or denial-of-service attacks on systems handling sensitive data. The flaw allows heap memory disclosure and corruption, which may expose sensitive information if exploited. Systems processing personal or health data under GDPR or HIPAA must ensure robust network security to prevent such breaches.

Mitigation Strategies

Upgrade Mongoose to version 7.23 or later immediately. Disable MG_ENABLE_IPV6 and MG_ENABLE_TCPIP if IPv6 or TCP/IP features are not required. Restrict access to PPP/PPPoE links to trusted adjacent peers only.

Hi! I’m here to help you understand CVE-2026-63626. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70