CVE-2020-25756 Memory corruption in n/a
A buffer overflow in the Mongoose library allows attackers to cause denial of service or execute code via crafted HTTP headers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-25756?
CVE-2020-25756 is a critical memory corruption vulnerability in Cesanta Mongoose, published on 18 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A buffer overflow vulnerability exists in the mg_get_http_header function in Cesanta Mongoose 6.18 due to a lack of bounds checking. A crafted HTTP header can exploit this bug. NOTE: a committer has stated "this will not happen in practice.
Weakness: CWE-120
Which versions are affected by CVE-2020-25756?
It affects 1 product.
Products include Cesanta Mongoose.
How do I fix CVE-2020-25756?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-25756 being exploited?
There is no known exploitation of CVE-2020-25756 in the wild and no public exploit code.
Other vulnerabilities in Cesanta Mongoose
Sources
Also known as DEBIAN-CVE-2020-25756, GHSA-p959-hwch-c2xg.