[Git][security-tracker-team/security-tracker][master] Add some mongoose CVEs affecting swupdate

Bastian Germann (@bage) bage at debian.org
Mon May 11 18:43:14 BST 2026



Bastian Germann pushed to branch master at Debian Security Tracker / security-tracker


Commits:
ba2a6c06 by Bastian Germann at 2026-05-11T19:43:01+02:00
Add some mongoose CVEs affecting swupdate

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -80116,6 +80116,7 @@ CVE-2025-65503 (Use after free in endpoint destructors in Redboltz async_mqtt 10
 	NOT-FOR-US: Redboltz async_mqtt
 CVE-2025-65502 (Null pointer dereference in add_ca_certs() in Cesanta Mongoose before  ...)
 	- mongoose <not-affected> (Fixed before or with initial upload)
+	- swupdate 2025.12+dfsg-1
 	NOTE: https://github.com/cesanta/mongoose/issues/3306
 	NOTE: https://github.com/cesanta/mongoose/commit/64abf061bf018fd78f31c200a57a3fb04f9f3ef2 (7.20)
 CVE-2025-65501 (Null pointer dereference in coap_dtls_info_callback() in OISM libcoap  ...)
@@ -314142,6 +314143,7 @@ CVE-2023-33934 (Improper Input Validation vulnerability in Apache Software Found
 	NOTE: https://lists.apache.org/thread/jsl6dfdgs1mjjo1mbtyflyjr7xftswhc
 CVE-2023-2905 (Due to a failure in validating the length of a provided MQTT_CMD_PUBLI ...)
 	- mongoose <not-affected> (Fixed before or with initial upload)
+	- swupdate 2024.12+dfsg-1
 CVE-2023-3223 (A flaw was found in undertow. Servlets annotated with @MultipartConfig ...)
 	- undertow 2.3.18-1 (bug #1054893)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2209689
@@ -320281,6 +320283,7 @@ CVE-2023-34203 (In Progress OpenEdge OEM (OpenEdge Management) and OEE (OpenEdge
 	NOT-FOR-US: Progress OpenEdge OEM
 CVE-2023-34188 (The HTTP server in Mongoose before 7.10 accepts requests containing ne ...)
 	- mongoose <not-affected> (Fixed before or with initial upload)
+	- swupdate 2024.12+dfsg-1
 	NOTE: https://github.com/cesanta/mongoose/commit/4663090a8fb036146dfe77718cff612b0101cb0f (7.10)
 	NOTE: smplayer embeds a copy, which is unused in any released version and disabled since 18.5.0~ds1-1
 CVE-2023-34021 (Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Andy Moy ...)
@@ -490773,16 +490776,19 @@ CVE-2021-26531
 	RESERVED
 CVE-2021-26530 (The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 (compile ...)
 	- mongoose <not-affected> (Fixed before or with initial upload)
+	- swupdate 2022.12+dfsg-1
 	NOTE: https://github.com/cesanta/mongoose/issues/1204
 	NOTE: https://github.com/cesanta/mongoose/commit/8e520756366ca5739f13dc6ad65fcf269dbbc994 (7.1)
 	NOTE: smplayer embeds a copy, which is unused in any released version and disabled since 18.5.0~ds1-1
 CVE-2021-26529 (The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7- ...)
 	- mongoose <not-affected> (Fixed before or with initial upload)
+	- swupdate 2022.12+dfsg-1
 	NOTE: https://github.com/cesanta/mongoose/issues/1203
 	NOTE: https://github.com/cesanta/mongoose/commit/8e520756366ca5739f13dc6ad65fcf269dbbc994 (7.1)
 	NOTE: smplayer embeds a copy, which is unused in any released version and disabled since 18.5.0~ds1-1
 CVE-2021-26528 (The mg_http_serve_file function in Cesanta Mongoose HTTP server 7.0 is ...)
 	- mongoose <not-affected> (Fixed before or with initial upload)
+	- swupdate 2022.12+dfsg-1
 	NOTE: https://github.com/cesanta/mongoose/issues/1203
 	NOTE: https://github.com/cesanta/mongoose/commit/8e520756366ca5739f13dc6ad65fcf269dbbc994 (7.1)
 	NOTE: smplayer embeds a copy, which is unused in any released version and disabled since 18.5.0~ds1-1
@@ -524165,6 +524171,7 @@ CVE-2020-25888
 	RESERVED
 CVE-2020-25887 (Buffer overflow in mg_resolve_from_hosts_file in Mongoose 6.18, when r ...)
 	- mongoose <not-affected> (Fixed before or with initial upload)
+	- swupdate 2022.12+dfsg-1
 	NOTE: https://github.com/cesanta/mongoose/issues/1140
 CVE-2020-25886
 	RESERVED
@@ -524500,6 +524507,7 @@ CVE-2020-25757 (A lack of input validation and access controls in Lua CGIs on D-
 	NOT-FOR-US: D-Link
 CVE-2020-25756 (A buffer overflow vulnerability exists in the mg_get_http_header funct ...)
 	- mongoose <not-affected> (Fixed before or with initial upload)
+	- swupdate 2022.12+dfsg-1
 	NOTE: https://github.com/cesanta/mongoose/issues/1135
 	NOTE: smplayer embeds a copy, which is unused in any released version and disabled since 18.5.0~ds1-1
 CVE-2020-25755 (An issue was discovered on Enphase Envoy R3.x and D4.x (and other curr ...)
@@ -586772,6 +586780,7 @@ CVE-2019-19308 (In text_to_glyphs in sushi-font-widget.c in gnome-font-viewer 3.
 	NOTE: Crash in GUI tool, no security impact
 CVE-2019-19307 (An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6. ...)
 	- mongoose <not-affected> (Fixed before or with initial upload)
+	- swupdate 2021.04-1
 	NOTE: https://github.com/cesanta/mongoose/issues/1055
 	NOTE: smplayer embeds a copy, which is unused in any released version and disabled since 18.5.0~ds1-1
 CVE-2019-19306 (The Zoho CRM Lead Magnet plugin 1.6.9.1 for WordPress allows XSS via m ...)
@@ -608467,6 +608476,7 @@ CVE-2019-13504 (There is an out-of-bounds read in Exiv2::MrwImage::readMetadata
 	NOTE: https://github.com/Exiv2/exiv2/commit/54f0bebca032d0286a0e48f47e67dfc6141fedff
 CVE-2019-13503 (mq_parse_http in mongoose.c in Mongoose 6.15 has a heap-based buffer o ...)
 	- mongoose <not-affected> (Fixed before or with initial upload)
+	- swupdate 2021.04-1
 	NOTE: https://github.com/cesanta/mongoose/pull/1035
 	NOTE: smplayer embeds a copy, which is unused in any released version and disabled since 18.5.0~ds1-1
 CVE-2019-13502
@@ -610072,6 +610082,7 @@ CVE-2019-12952
 	RESERVED
 CVE-2019-12951 (An issue was discovered in Mongoose before 6.15. The parse_mqtt() func ...)
 	- mongoose <not-affected> (Fixed before or with initial upload)
+	- swupdate 2021.04-1
 	NOTE: https://github.com/cesanta/mongoose/commit/b3e0f780c34cea88f057a62213c012aa88fe2deb (6.15)
 	NOTE: smplayer embeds a copy, which is unused in any released version and disabled since 18.5.0~ds1-1
 CVE-2019-12950 (An issue was discovered in TeamPass 2.1.27.35. From the sources/items. ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ba2a6c06737b88b6063da2b52e0eaec93b208869

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ba2a6c06737b88b6063da2b52e0eaec93b208869
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260511/f6ca4bbd/attachment.htm>


More information about the debian-security-tracker-commits mailing list