CVE-2023-34188: Cesanta Mongoose

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests.

Affected products

• Cesanta Mongoose: before 7.10 (fixed in 7.10)

Published 2023-06-23. Last modified 2026-06-17.