Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-2967: Cesanta Mongoose can be tricked into accepting false sources

CVE-2026-2967 · published 8 months ago

Summary

The TCP handling code in Cesanta Mongoose (versions up to 7.20) does not correctly verify where a connection is coming from. An attacker on the network could spoof the source of a connection and potentially influence the application’s behavior. Update to the latest Mongoose release or apply the vendor's patch as soon as possible.

What to do

Update debian swupdate to version 2025.12+dfsg-10.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	cesanta	mongoose	<= 7.20 `cpe:2.3:a:cesanta:mongoose::::::::`
Debian:14	debian	mongoose	All versions
Debian:11	debian	swupdate	All versions
Debian:12	debian	swupdate	All versions
Debian:13	debian	swupdate	All versions
Debian:14	debian	swupdate	< 2025.12+dfsg-10 Fix: upgrade to 2025.12+dfsg-10
Ubuntu:20.04:LTS	canonical	opencpn	All versions

Original advisory text

Cesanta Mongoose TCP Sequence Number net_builtin.c getpeer verification of source

A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This affects the function getpeer of the file /src/net_builtin.c of the component TCP Sequence Number Handler. The manipulation leads to improper verification of source of a communication channel. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

https://security-tracker.debian.org/tracker/CVE-2026-2967 Vendor Advisory
https://ubuntu.com/security/CVE-2026-2967 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-2967 Third Party Advisory
https://github.com/dwBruijn/CVEs/blob/main/Mongoose/tcp_rst.md Third Party Advisory
https://github.com/dwBruijn/CVEs/blob/main/Mongoose/tcp_rst.md#poc Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2967.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-2967 Vendor Advisory
https://vuldb.com/?ctiid.347334 Third Party Advisory
https://vuldb.com/?id.347334 Third Party Advisory
https://vuldb.com/?submit.755450 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.3 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-940Improper Verification of Source of a Communication Channel

Timeline

Published23 Feb 2026

Updated4 Nov 2026

First seen6 Mar 2026

Sources

CVE-2026-2967 · NVD

DEBIAN-CVE-2026-2967 · OSV

UBUNTU-CVE-2026-2967 · OSV

CVE-2026-2967 · OSV

Track software like this

Free during beta