{"id":"CVE-2021-26529","details":"The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable to remote OOB write attack via connection request after exhausting memory pool.","modified":"2026-07-09T00:13:09.973894Z","published":"2021-02-08T21:15:13.740Z","references":[{"type":"EVIDENCE","url":"https://github.com/cesanta/mongoose/issues/1203"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/cesanta/mongoose","events":[{"introduced":"4d9f8168b8bb264d4160b219b10ad43d2eb7c88a"},{"last_affected":"80d74e9e341d541f71c0fa587d22cec89be32dd5"},{"introduced":"54250f5fbfa1972b96ef593b457abd6184ea65a0"},{"last_affected":"54250f5fbfa1972b96ef593b457abd6184ea65a0"}],"database_specific":{"cpe":["cpe:2.3:a:cesanta:mongoose:*:*:*:*:*:*:*:*","cpe:2.3:a:cesanta:mongoose:7.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"6.7"},{"last_affected":"6.18"},{"introduced":"7.0"},{"last_affected":"7.0"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["7.0","6.18","6.17","6.16","6.15","6.14","6.13","6.12","6.11","6.10","6.9","6.7"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-26529.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"}]}