CVE-2025-65502: Cesanta Mongoose DoS Vulnerability

CVE-2025-65502 Overview

CVE-2025-65502 is a null pointer dereference vulnerability in the add_ca_certs() function of Cesanta Mongoose networking library versions before 7.2. The flaw occurs during Transport Layer Security (TLS) initialization when the OpenSSL function SSL_CTX_get_cert_store() returns NULL. The library dereferences this null pointer without validation, causing the host process to crash. Remote attackers can trigger the condition to cause a denial of service against applications that embed Mongoose for HTTP, MQTT, or WebSocket connectivity. The vulnerability is classified under [CWE-476] (NULL Pointer Dereference).

Critical Impact
Remote attackers can crash any application embedding Mongoose during TLS context setup, causing denial of service on IoT devices, embedded servers, and networking appliances that rely on the library.

Affected Products

Cesanta Mongoose versions prior to 7.2
Embedded devices and IoT firmware bundling vulnerable Mongoose builds
Applications using Mongoose with OpenSSL-backed TLS support

Discovery Timeline

2025-11-24 - CVE-2025-65502 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-65502

Vulnerability Analysis

Cesanta Mongoose is a widely deployed C networking library used in embedded systems, IoT devices, and industrial equipment. The add_ca_certs() function loads certificate authority (CA) certificates into an OpenSSL context to support TLS server or client operation. The function relies on SSL_CTX_get_cert_store() to obtain a pointer to the certificate store associated with the SSL context.

When SSL_CTX_get_cert_store() fails or the SSL context is not fully initialized, it returns a NULL pointer. The vulnerable code path in Mongoose does not check the return value before dereferencing it to add CA certificates. Dereferencing this null pointer produces a segmentation fault, terminating the process.

The attack requires user interaction according to the CVSS vector, typically meaning a remote peer must initiate the TLS handshake or configuration action that triggers the initialization path. The impact is limited to availability, with no confidentiality or integrity effects.

Root Cause

The root cause is missing return-value validation. The add_ca_certs() function assumes SSL_CTX_get_cert_store() always returns a valid store pointer and proceeds to call certificate-store operations on it. This assumption fails when OpenSSL cannot allocate or locate the store, converting a recoverable error condition into a fatal crash.

Attack Vector

An attacker with network access to a service embedding Mongoose can initiate a TLS session that forces the vulnerable initialization branch. Because the flaw resides in TLS setup, no authentication is required, and the crash occurs before any application-layer processing. The fix, delivered in Mongoose Pull Request #3307, adds validation of the return value before use.

See the GitHub Issue Discussion for technical details of the reproduction path.

Detection Methods for CVE-2025-65502

Indicators of Compromise

Unexpected process termination or segmentation faults in services linking against libmongoose during TLS initialization
Core dumps referencing add_ca_certs or SSL_CTX_get_cert_store in the stack trace
Repeated service restarts correlated with inbound TLS connection attempts from untrusted sources

Detection Strategies

Inventory all applications and firmware images that statically or dynamically link Mongoose and identify versions below 7.2
Monitor process crash logs and systemd journal entries for repeated failures of services exposing TLS endpoints
Use software composition analysis (SCA) tools to flag vulnerable Mongoose versions in build pipelines and container images

Monitoring Recommendations

Alert on abnormal termination rates for embedded services and IoT device management interfaces
Track TLS handshake failures followed by connection resets from the same source addresses
Review egress and ingress network telemetry for repeated malformed TLS ClientHello traffic targeting Mongoose-based services

How to Mitigate CVE-2025-65502

Immediate Actions Required

Upgrade Cesanta Mongoose to version 7.2 or later in all affected applications and firmware images
Rebuild and redeploy any statically linked binaries that ship a vulnerable Mongoose copy
Restrict network exposure of TLS endpoints to trusted networks until patched builds are deployed

Patch Information

The fix is available in Cesanta Mongoose Pull Request #3307, which adds a null check for the value returned by SSL_CTX_get_cert_store() inside add_ca_certs(). Downstream projects should update their vendored Mongoose sources and rebuild affected artifacts.

Workarounds

Place vulnerable services behind a TLS-terminating reverse proxy so the proxy handles handshake initialization instead of Mongoose
Apply network-level access controls to limit TLS connections to authenticated peers only
Configure service supervisors to rate-limit automatic restarts, reducing the impact of repeated crash attempts while patching is in progress

bash

# Configuration example: update vendored Mongoose in a source tree
cd third_party/mongoose
git fetch origin
git checkout 7.2
cd ../..
make clean && make