CVE-2026-6986

Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verification

State: Published
Severity: 6.3 Medium
Published: Apr 25, 2026
Updated: Apr 27, 2026
Reserved: Apr 24, 2026

Description

A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This issue affects the function mg_aes_gcm_decrypt of the file /src/tls_aes128.c of the component GCM Authentication Tag Handler. Such manipulation leads to improper verification of cryptographic signature. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 7.21 is capable of addressing this issue. It is advisable to upgrade the affected component. VulDB has contacted the vendor early and they confirmed quickly, that this issue got fixed already.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	3.7 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C	VulDB
3.0	3.7 Low	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C	VulDB
2.0	2.6 Low	AV:N/AC:H/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-347 Improper Verification of Cryptographic Signature
CWE-345 Insufficient Verification of Data Authenticity

Affected Products

Product	Versions
MongooseCesanta	7.0Affected 7.1Affected 7.2Affected 7.3Affected 7.4Affected 7.5Affected 7.6Affected 7.7Affected 7.8Affected 7.9Affected 7.10Affected 7.11Affected 7.12Affected 7.13Affected 7.14Affected 7.15Affected 7.16Affected 7.17Affected 7.18Affected 7.19Affected 7.20Affected 7.21Not affected

References

VDB-359529 | Cesanta Mongoose GCM Authentication Tag tls_aes128.c mg_aes_gcm_decrypt signature verificationvdb-entrytechnical-description
VDB-359529 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #796231 | Cesanta Mongoose 7.20 Improper Verification of Cryptographic Signaturethird-party-advisory
https://github.com/dwBruijn/CVEs/blob/main/Mongoose/AESGCM.mdexploit
https://github.com/cesanta/mongoose/releases/tag/7.21patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.