CVE-2026-2966 - Vulnerability Analysis

Overview

Cesanta Mongoose <= 7.20 contains an insufficient randomness vulnerability caused by manipulation of the "random" argument in mg_sendnsreq function of DNS Transaction ID Handler, letting remote attackers potentially predict DNS transaction IDs, exploit requires high complexity.

Severity & Score

Impact

Attackers can predict DNS transaction IDs, potentially enabling DNS spoofing or cache poisoning attacks.

Mitigation

Update to the latest version when available.

References

• https://github.com/dwBruijn/CVEs/blob/main/Mongoose/mg_sendnsreq.md
• https://github.com/dwBruijn/CVEs/blob/main/Mongoose/mg_sendnsreq.md#poc
• https://vuldb.com/?ctiid.347333
• https://vuldb.com/?id.347333
• https://vuldb.com/?submit.755304

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner