CVE-2018-20356
CRITICALCesanta Mongoose < 6.13 - Use-After-Free in mg_http_free_proto_data_cgi
Title source: llmDescription
An invalid read of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution.
References (1)
Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://github.com/insi2304/mongoose-6.13-fuzz/blob/master/Simplest_Web_Server_Use_After_Free-read_mg_http_free_proto_data_cgi.png
Scores
CVSS v3
9.8
EPSS
0.0357
EPSS Percentile
88.0%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-416
Status
published
Products (1)
cesanta/mongoose
< 6.13
Published
Jun 10, 2019
Tracked Since
Feb 18, 2026