Mongoose 7.22 Security Patch: Buffer Overflows, SSRF, XSS, and TLS Vulns

Vulnerability Overview This version (7.22) contains numerous security fixes, reflecting the increased use of AI-driven security tools and valuable contributions from the security research community. Many of the resolved issues have not yet been assigned CVE identifiers; the assignment process is ongoing, and these release notes will be updated as more CVEs become available. Impact Scope CVE-2028-37635: floating-point performance issue MQTT Server Stack Overflow mqt_next_topic Out-of-Bounds (OOB) Remote Denial of Service (Infinite Loop) via Integer Overflow in the Built-in TLS DER Parser Built-in TLS Accepts Non-CA Certificates as Intermediate Certificates ETH L2 Frame Header AES GCM Verification without Tag TCP Options Infinite Loop mg_http_get_header_var OOB Read RSA Zero-Length Modulus OOB Read X25519 Low-Order Points Not Checked ICMPv6 NDP NA OOB Read Multipart Boundary/Header Scan Logic Error Leading to Data Corruption and Content Type Bypass HTTP/1.0 Detection Bypass Enabling Request Smuggling SSI Path Traversal – Arbitrary File Read via Directive Stored XSS via Unescaped Filenames in Directory Listings open() Stack Overflow via wccast on MAX_PATH Path mg_tcpip_driver_tms570_tx Short Frame Transmission State Buffer Content ENET_IRQHandler RX Descriptor Not Reclaimed Error – RX Ring Stalls ssl_keylog_cb NULL Dereference on Open Failure fopen Missing fclose Leaking FatFs Lock on Allocation Failure mg_file_write_temp File Opened without O_EXCL – Symbolic Link Following mg_file_write Temporary Name Truncation Leading to Original File Deletion w5100_rx Wrapping RX Path Copies r Bytes cyw_spi_tx SPI Alignment Padding Index uint32_t Buffer with Byte Offset mg_getsockaddr Socket Leak on UDP Connection Failure rx_ip Truncating DHCP Option Size _t Underflow OOB Read rx_dhcp_client 32-bit Overflow in DHCP Lease Millisecond Conversion ppp_rx Fixed-Size Hexdump OOB Read on Short Unknown Protocol Frames ppp_handle_gpcp Attacker-Controlled IPCP Length – OOB Read find_opt Zero-Length PPP Options – Infinite Loop rx_ndp_na NDP NA Missing Option Length Check – OOB Read rx_ndp_ns ICMPv6 NS Insufficient Minimum Length – OOB Read rx_ip6 IPv6 Extension Header OOB Read, 16-bit len Wraparound NDP RA Allows Any MTU Value mg_ssl 1-byte OOB Stack Overflow in SSI End Tag Check mg_ssl obuf Buffer Leak on Allocation Failure DNS Transaction ID Order – Enabling Response Injection MQTT v5 Attribute Boundary Check Using Relative Offset Against Absolute Position skip_chunk_by_one OOB Read in Chunked HTTP CRLF Check mg_rsa_parse_key OOB Read Before Boundary Check in Debug Logging gcm_finish Unbound tag_len OOB Read mg_dtoa Stack Overflow Appending Exponent Suffix precompute_slide_window NULL Dereference on OOM more_camps NULL Dereference in Loop After Failure bi_initialize / alloc NULL Dereference on OOM mg_ts_client_recv_hello size_t Underflow in ext_len Boundary Check mg_ts_client_recv_hello_ext_len Fixed Offset OOB Read mg_ts_server_recv_hello_session_id_len OOB Read mg_ts_init EC Key Corruption Due to Missing Return – Memory Leak on Error Path mg_ts_client_recv_hello key_share Extension OOB Read mg_ts_verify_cert_signature OOB Read on Short ECDSA Integer mg_ts_parse_cert_der pubkey BIT STRING Length Underflow – OOB Read mg_der_to_tlv Long-Form DER Length OOB Read mg_der_find_oid Unbounded Recursion in Constructed DER Tags mg_ts_recv_cert Certificate Chain Not Checked – OOB Read mg_random rand() Fallback for TLS Key Material TLS Certificate Not Validated Against Hardcoded 2025-01-01 String RSA-PSS Certificate Verification Checks Only 0x0c Tail Remediation CVE-2028-37635: Fix floating-point performance issue MQTT Server Stack Overflow: Fix stack overflow issue mqt_next_topic OOB: Fix OOB read issue Remote Denial of Service (Infinite Loop): Fix integer overflow in the built-in TLS DER parser Built-in TLS Accepts Non-CA Certificates: Fix issue accepting non-CA certificates as intermediate certificates ETH L2 Frame Header: Fix ETH L2 frame header issue AES GCM Verification without Tag: Fix AES GCM verification without tag issue TCP Options Infinite Loop: Fix TCP options infinite loop issue mg_http_get_header_var OOB Read: Fix mg_http_get_header_var OOB read issue RSA Zero-Length Modulus OOB Read: Fix RSA zero-length modulus OOB read issue X25519 Low-Order Points Not Checked: Fix X25519 low-order points not checked issue ICMPv6 NDP NA OOB Read: Fix ICMPv6 NDP NA OOB read issue Multipart Boundary/Header Scan Logic Error: Fix multipart boundary/header scan logic error HTTP/1.0 Detection Bypass: Fix HTTP/1.0 detection bypass issue SSI Path Traversal: Fix SSI path traversal issue Stored XSS: Fix stored XSS issue open() Stack Overflow: Fix open() stack overflow issue mg_tcpip_driver_tms570_tx Short Frame Transmission: Fix mg_tcpip_driver_tms570_tx short frame transmission issue ENET_IRQHandler RX Descriptor Not Reclaimed: Fix ENET_IRQHandler RX descriptor not reclaimed issue ssl_keylog_cb NULL Dereference: Fix ssl_keylog_cb NULL dereference issu

Goal Reached Thanks to every supporter — we hit 100%!

Mongoose 7.22 Security Patch: Buffer Overflows, SSRF, XSS, and TLS Vulns

More from this source