CVE-2026-5244 is a heap based buffer overflow (CWE-122) in the TLS 1.3 handler of Cesanta Mongoose up to version 7.20, in mg_tls_recv_cert. NVD scores it 7.3 high and says a public exploit exists. The fix is in Mongoose 7.21, so upgrade and rebuild.
What's affected
Cesanta Mongoose up to and including 7.20. Version 7.21 fixes it, per the record and the project's release page. The patch is commit 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1.
The flaw is in mg_tls_recv_cert in mongoose.c, in the built-in TLS 1.3 stack, and involves the pubkey argument. It matters if you use Mongoose's own TLS, not an external library such as mbedTLS or OpenSSL.
The record notes that the vendor responded quickly and professionally and released a fixed version.
How to check if you're exposed
Mongoose is two source files that you copy into your project, so there is no package to query. Read the version in your copy:
grep -n "MG_VERSION" mongoose.h
If it shows 7.20 or lower, you are on an affected version. Then check whether the built-in TLS is on, by looking for the MG_TLS setting in your build:
grep -rn "MG_TLS" mongoose_config.h Makefile CMakeLists.txt 2>/dev/null
If your device uses an external TLS library instead, this flaw does not apply.
You can also run the free in-browser dependency scan or browse the Gold directory to see where this component shows up in your stack.
What to do now
- Find every product that embeds mongoose.c and read its version.
- Replace the two files with version 7.21 or later and rebuild.
- Ship new firmware to devices in the field, starting with ones that accept TLS connections from the internet.
- Check supplier devices that may embed Mongoose and ask for fixed firmware.
- Add the Mongoose version to your software bill of materials.
Why it matters
The built-in TLS 1.3 handler parses a certificate sent by the peer. The record says that manipulating the public key argument causes a heap based buffer overflow, classed as CWE-122 and the broader CWE-119. A server that accepts client certificates, or a client that connects to an untrusted server, reads input from outside.
Mongoose is used across many small devices, and a single header and source copy means the bug spreads without showing up in package manager reports. That is the main reason an inventory of embedded components matters.
The record does not mark the CVE as a CISA Known Exploited Vulnerability, though a public exploit exists.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Why will my scanner miss this?
Mongoose is vendored as source files, so package manifests do not list it. You need file or source based detection.
Is an external TLS library a workaround?
If your build uses mbedTLS or OpenSSL for TLS, the built-in handler is not used. Check your build to be sure.
Sources
Last reviewed: 19 October 2026.
