CVE-2025-51495 Integer overflow in n/a
An integer overflow in Mongoose's WebSocket component allows attackers to crash the application or potentially execute code via buffer overflow.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-51495?
CVE-2025-51495 is a high-severity vulnerability in Cesanta Mongoose, published on 29 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17. By sending a specially crafted WebSocket request, an attacker can cause the application to crash. If downstream vendors integrate this component improperly, the issue may lead to a buffer overflow.
Weakness: CWE-190
Which versions are affected by CVE-2025-51495?
It affects 1 product.
Products include Cesanta Mongoose.
How do I fix CVE-2025-51495?
Upgrade to a fixed version.
Is CVE-2025-51495 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-51495 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Cesanta Mongoose
Sources
Also known as DEBIAN-CVE-2025-51495, GHSA-83rc-g55p-8xj2, UBUNTU-CVE-2025-51495.