CVE-2024-42392

Improper Neutralization of Delimiters in Mongoose Web Server library

State: Published
Severity: 4.0 Medium
Published: Nov 18, 2024
Updated: Sep 8, 2026
Reserved: Jul 31, 2024

Description

Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an infinite loop bug if the input string contains unexpected characters.

Scores

CVSS	Score	Vector	Source
3.1	4.0 Medium	CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H	Nozomi

Weaknesses

CWE-140 Improper Neutralization of Delimiters

Affected Products

Product	Versions
Mongoose Web ServerCesanta	7.14 and earlierAffected

References

https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-42392
https://cert-portal.siemens.com/productcert/html/ssa-142885.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.