CVE-2023-34188

HIGH

Mongoose < 7.10 - Denial of Service via Negative Content-Length Header

Title source: llm
STIX 2.1

Description

The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests.

References (5)

Core 5

Scores

CVSS v3 7.5
EPSS 0.0081
EPSS Percentile 52.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-1284
Status published
Products (1)
cesanta/mongoose < 7.10
Published Jun 23, 2023
Tracked Since Feb 18, 2026