CVE WatchOct 14, 2026

CVE-2026-63626

Mongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16-bit IPv6CP len fiel

CVSS

8.8

High

EPSS

—

KEV

—

Exploit Today

0-100

Published: Oct 14, 2026 · Last modified: Oct 14, 2026 · CWE-122 · CWE-125

EPSS · 30d

Not enough EPSS history yet.

Technical description

Mongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MG_ENABLE_TCPIP and MG_ENABLE_IPV6, an unauthenticated adjacent peer can complete the required LCP exchange and send a short Configure-Request with an oversized length, causing ppp_tx_frame() to read beyond recv_queue.buf and write beyond tx.buf. The same length misuse can also expose adjacent heap bytes in a reply or hang the event loop through find_opt(). This issue is fixed in version 7.23.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-798227.1 HIG

—

———A security vulnerability in HPE NonStop TNS/X Native Inspect may cause corruption of address and potentially redirect execution flow.1h CVE-2026-58100—

—

———kqueue_fork_copy_knote() indexed into the child's file descriptor table using a knote's file descriptor number without a bounds check. Because the child's table is copied before knotes are transferred, a concurrent thread in the parent could grow the parent's table and register knotes with file descriptor numbers beyond the end of the child's table, causing an out-of-bounds read. An unprivileged local user may be able to exploit these races to escalate privileges.1h CVE-2026-101307—

—

———When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer can trigger the expansion by sending a sufficient number of ACKs on an established connection. A remote attacker who can establish a TCP connection to a system using the RACK stack can trigger an out-of-bounds write of approximately 512 KB in the kernel heap possibly resulting in a kernel panic.1h CVE-2026-766675.7 MED

—

———A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.3h CVE-2026-766664.7 MED

—

———A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.3h CVE-2026-766657.1 HIG

—

———A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow.3h