CVE-2026-2967 - Vulnerability Analysis

Overview

Cesanta Mongoose <= 7.20 contains an improper verification of source in TCP Sequence Number Handler's getpeer function, letting remote attackers potentially bypass source verification, exploit requires complex conditions.

Severity & Score

Impact

Remote attackers can bypass source verification of communication channels, potentially leading to unauthorized access or communication spoofing.

Mitigation

Update to the latest version.

References

• https://github.com/dwBruijn/CVEs/blob/main/Mongoose/tcp_rst.md
• https://github.com/dwBruijn/CVEs/blob/main/Mongoose/tcp_rst.md#poc
• https://vuldb.com/?ctiid.347334
• https://vuldb.com/?id.347334
• https://vuldb.com/?submit.755450

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner