CVE-2026-2966 Cesanta Mongoose DNS Transaction ID dns.c mg_sendnsreq random values
Insufficiently random DNS transaction IDs in Cesanta Mongoose allow remote attackers to potentially bypass security checks via complex attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-2966?
CVE-2026-2966 is a medium-severity vulnerability in Cesanta Mongoose, published on 23 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A weakness has been identified in Cesanta Mongoose up to 7.20. The impacted element is the function mg_sendnsreq of the file /src/dns.c of the component DNS Transaction ID Handler. Executing a manipulation of the argument random can lead to insufficiently random values. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is regarded as difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Which versions are affected by CVE-2026-2966?
It affects 1 product.
Products include Cesanta Mongoose.
How do I fix CVE-2026-2966?
No fix published yet.
Is CVE-2026-2966 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-2966 exists.
Other vulnerabilities in Cesanta Mongoose
Sources
Also known as DEBIAN-CVE-2026-2966, GHSA-m5mm-h952-fxjj, JLSEC-2026-366, UBUNTU-CVE-2026-2966.