CVE-2024-42385

Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an out-of-bound memory write if the PEM certificate contains unexpected characters.

Scoring

Severity

MEDIUM

CVSS base score

4

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H

EPSS probability

0.10%

CWE

CWE-140

Published

2024-11-18

Last modified

2026-09-08

Affected products

• Cesanta Mongoose Web Server

Weakness type

• CWE-140

Related vulnerabilities

• CVE-2026-33457 — Potential livestatus injection in prediction graph page
• CVE-2026-33456 — Potential livestatus injection in notification test
• CVE-2026-33455 — Livestatus injection in monitoring quicksearch
• CVE-2026-21691 — iccDEV has Type Confusion in CIccTag:IsTypeCompressed()
• CVE-2025-52989 — Junos OS and Junos OS Evolved: Annotate configuration command can be used to change the configuration
• CVE-2025-32918 — Livestatus injection in autocomplete endpoint
• CVE-2025-48879 — OctoPrint Vulnerable to Denial of Service through malformed HTTP request
• CVE-2024-38866 — Livestatus Injection in dynmaps

Markdown version · Browse all CVEs