Description
The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://github.com/cesanta/mongoose/commit/4663090a8fb036146dfe77718cff612b0101cb0f ↗
- https://github.com/cesanta/mongoose/pull/2197 ↗
- https://github.com/cesanta/mongoose/compare/7.9...7.10 ↗
- https://blog.narfindustries.com/blog/narf-discovers-critical-vulnerabilities-in-cesanta-mongoose-http-server ↗
- https://security.netapp.com/advisory/ntap-20250228-0001/ ↗