CVE-2026-5245 Overview
CVE-2026-5245 is a stack-based buffer overflow in Cesanta Mongoose versions up to and including 7.20. The flaw resides in the handle_mdns_record function inside mongoose.c, part of the mDNS Record Handler component. An attacker can manipulate the buf argument to overflow a fixed-size stack buffer. The vulnerability is reachable over the network without authentication, but exploitation requires a high degree of complexity. The issue is tracked under [CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer]. Cesanta released version 7.21 containing the fix in commit 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1.
Critical Impact
Remote attackers can trigger a stack-based buffer overflow in the Mongoose mDNS handler, potentially affecting confidentiality, integrity, and availability of embedded devices and applications that link against the library.
Affected Products
- Cesanta Mongoose versions up to 7.20
- Embedded devices and IoT firmware that integrate the Mongoose networking library
- Applications enabling the mDNS Record Handler component
Discovery Timeline
- 2026-04-02 - CVE-2026-5245 published to NVD
- 2026-04-29 - Last updated in NVD database
Technical Details for CVE-2026-5245
Vulnerability Analysis
Mongoose is an embedded networking library widely used in IoT firmware and embedded applications. The handle_mdns_record function processes incoming Multicast DNS (mDNS) records but fails to enforce proper bounds on the buf argument before copying data onto the stack. A crafted mDNS record that exceeds the expected buffer size overwrites adjacent stack memory, including saved return addresses and frame pointers.
Because mDNS operates over UDP on the local network, an attacker on the same broadcast domain can transmit malicious records without prior authentication. The vendor and VulDB note the exploit has been made public, though successful exploitation requires precise control over record contents and timing. Impact is rated as limited across confidentiality, integrity, and availability, consistent with the constraints typical of embedded targets and stack mitigations such as canaries.
Root Cause
The root cause is insufficient input validation in handle_mdns_record within mongoose.c. The function does not adequately check the length of attacker-controlled data before writing it into a fixed-size stack buffer, violating safe memory boundary enforcement [CWE-119].
Attack Vector
The vulnerability is exploited remotely via the network. An attacker sends a malformed mDNS record to a Mongoose-based service listening on the multicast address. No user interaction or authentication is required. The published commit 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1 constrains buffer handling in the mDNS parser, indicating where the overflow occurs.
No verified proof-of-concept code is included here. Refer to the GitHub Commit 0d882f1b for the precise code path and patch diff.
Detection Methods for CVE-2026-5245
Indicators of Compromise
- Unexpected crashes or restarts of Mongoose-based services coinciding with inbound mDNS traffic on UDP port 5353.
- Oversized or malformed mDNS records originating from untrusted hosts on the local segment.
- Stack canary violations or segmentation faults logged by embedded runtimes processing mDNS responses.
Detection Strategies
- Inventory all firmware and applications linking against Cesanta Mongoose and verify the bundled library version against 7.21.
- Inspect mDNS traffic for records exceeding RFC 6762 expected field lengths, particularly oversized name or rdata fields.
- Apply network-based signatures that flag malformed multicast DNS queries and responses on UDP 5353.
Monitoring Recommendations
- Capture service crash telemetry from embedded and IoT devices and correlate with network captures of mDNS traffic.
- Monitor egress and lateral mDNS traffic patterns for anomalies indicative of probing or fuzzing against the mDNS handler.
- Track upstream advisories in the GitHub Mongoose Repository for related fixes or regressions.
How to Mitigate CVE-2026-5245
Immediate Actions Required
- Upgrade Mongoose to version 7.21 or later, which contains the fix in commit 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1.
- Rebuild and redeploy any firmware or applications that statically link the vulnerable Mongoose source.
- Restrict exposure of mDNS services to trusted network segments where the upgrade cannot be applied immediately.
Patch Information
The vendor released GitHub Release 7.21 addressing the issue. The applicable patch is published in the GitHub Commit 0d882f1b. Cesanta responded professionally and released the fixed version promptly after disclosure.
Workarounds
- Disable the mDNS Record Handler in Mongoose builds where the feature is not required by compiling without mDNS support.
- Block inbound UDP 5353 traffic from untrusted networks at the perimeter or host firewall.
- Isolate affected devices on dedicated VLANs to limit reachable attack surface until firmware updates are deployed.
# Configuration example: block external mDNS traffic on Linux hosts
iptables -A INPUT -p udp --dport 5353 ! -s 192.0.2.0/24 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
