{"id":"CVE-2026-5246","summary":"Cesanta Mongoose P-384 Public Key mongoose.c mg_tls_verify_cert_signature authorization","details":"A vulnerability was determined in Cesanta Mongoose up to 7.20. Affected is the function mg_tls_verify_cert_signature of the file mongoose.c of the component P-384 Public Key Handler. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. Attacks of this nature are highly complex. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 7.21 is able to address this issue. This patch is called 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.","modified":"2026-08-12T16:25:41.926623Z","published":"2026-04-02T09:45:11.602Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-285","CWE-639"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5246.json"},"references":[{"type":"WEB","url":"https://github.com/cesanta/mongoose/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5246.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5246"},{"type":"ADVISORY","url":"https://vuldb.com/submit/770104"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/354827"},{"type":"REPORT","url":"https://vuldb.com/vuln/354827/cti"},{"type":"FIX","url":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"},{"type":"FIX","url":"https://github.com/cesanta/mongoose/releases/tag/7.21"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/cesanta/mongoose","events":[{"introduced":"54250f5fbfa1972b96ef593b457abd6184ea65a0"},{"fixed":"b1c2ffe1a0aa13e3d94075b1a2c66b8b43ac9116"},{"fixed":"0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"}],"database_specific":{"cpe":"cpe:2.3:a:cesanta:mongoose:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"7.0"},{"fixed":"7.21"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["7.0","7.1","7.10","7.11","7.12","7.13","7.14","7.15","7.16","7.17","7.18","7.19","7.2","7.20","7.3","7.4","7.5","7.6","7.7","7.8","7.9"],"database_specific":{"vanir_signatures_modified":"2026-08-12T16:25:41Z","vanir_signatures":[{"digest":{"line_hashes":["310195857280588516826327302251308476623","247067085422557109988189947515934599102","313811670961247816809835158680447031175","321039469075947274274862094326940937842","149204095977579775158569319523296377014","37415825601299739301022543248796799547","222981842113018445298086962150850787644","227108120022272002364766608411054073442","305162833108134619902342219290277501935"],"threshold":0.9},"id":"CVE-2026-5246-002f53b6","signature_type":"Line","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"src/str.c"},"deprecated":false},{"id":"CVE-2026-5246-0e3743ab","signature_type":"Function","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"src/net_builtin.c","function":"getpeer"},"deprecated":false,"digest":{"function_hash":"93212850972103637565164108427977558","length":903}},{"signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"src/tls_builtin.c","function":"mg_tls_recv_record"},"deprecated":false,"digest":{"function_hash":"63904093970639459445221502944134231697","length":2376},"id":"CVE-2026-5246-0ec0c030","signature_type":"Function"},{"target":{"file":"src/dns.c","function":"handle_mdns_query"},"deprecated":false,"digest":{"function_hash":"234094490269337275516703077143475779957","length":4366},"id":"CVE-2026-5246-1d8d5131","signature_type":"Function","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"},{"signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"src/json.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["200971470672070433806574787162350782981","246459084421158409508271879636616685473","178497673632907847985424603495005254580","147625765234870644987741089606512115234","125608274239893015702254416244430154117","106674142984676130989977692530078834796","317818015869759693059115042658936654867","249683910300377170747782883355612564449","130718674766101239475935730716936852871","250665637455326381798507422100577635451","181062300907135882941523102720798240188","198632693690028902544562145243396211538"]},"id":"CVE-2026-5246-1ecae67e","signature_type":"Line"},{"id":"CVE-2026-5246-334b820d","signature_type":"Function","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"mongoose.c","function":"mg_chacha20_poly1305_decrypt"},"deprecated":false,"digest":{"length":359,"function_hash":"214187038073003652483917653332949765372"}},{"id":"CVE-2026-5246-37675a34","signature_type":"Line","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"src/http.c"},"deprecated":false,"digest":{"line_hashes":["72108969968671287165676073113908540097","260764798821274886585180251291715723352","311516043145510413929413847446881645078","33408407914328545099672704711216714115","180159965983064713659004726001301644810","75864077088983988380883324682721108431","283514182450017727361918624070024043260","174545628510337453787793780372496772280","169280853188626589078984246568509550670","249274382086140367465238988260062558767","283298895752339736303522186100799821953","309370920187928618663289771021288202439","40326253743574648834541450959435781468","168036368398611063048019074455283493565","142041783403648622183734022793455247935","337785171986507366427061745683328845438"],"threshold":0.9}},{"source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"src/tls_aes128.c"},"deprecated":false,"digest":{"line_hashes":["166377927564541163292838571970413559447","167263868293715453694677016447384973503","506666656578193056911612979893655164","46148227840654825310039885552784555514","51486828226111308951402893970210295231","264778674555001533239524250037403968916","270184295426408907650816603346375894996","215483416289239105373085481951564675827","104522920709814054877500805439768270288","144422475653927737875015228092684653629","322158298067059941551515647401405828285","64138746259907601956727958666149641080","178740577980772207894443934468463984962","105092733098238568528332336540088977162","214107427827052325797984003184624248193","69851016955281771236625038635337133031","339531381409716696330867507336020855523","65435455913219771565833736959607063610","111243338608708823626753390781387202342","115240527536752730628919954176480783101","106631365053193492567279455858649416064","280098514755188230095378998464723237835","99618655361699004483939623708081829375","4360123043167917805668550763739904861","279479400312961436471337999409879455622","106877907065056045032335256425728047154","17414785322227276591322205728357532476","197373848301137846789942809445978967177","130403767094565810059314586724407927819","196192752971554878422409343007146370882","161912795029919786466536487177815230373","313060015622709387875202425946162945281","102947552618209418802711564820465321146","145457683343268548700386219445880502576","183620710663677804024233103701738885573","89907086326744855360949479765887958690","291312107145074695395514728944773432558","136753443340113592476679800288972712523","153727050990137812601449015336433060","197373848301137846789942809445978967177","130403767094565810059314586724407927819","255997722559097574620098256938064459576","68441160989040999281218388098010292829","176364859884227006479435786866928776958","201970721734579392239978390934633053295","151903328359582460231684335964360945870","59784093424306230654489344977207941672","20459915730428632493000693870709414169","336891102694408727580294786460490492846","253066278568950610856613401423838628589","288519642934558429790274657646736142116","192950257664883424999665004016645343714","227692618715369704900486678700455716040","119835196798782698214675597940995916024","149959037209250504984573260640700311401","53440401303995629403167703346471190787","119937427392194843040101836720800183858","198651752223389311820485040931269337192","182843108111491156423179287511188709866","308096605264013075853203281581807228145","325664619094998110495016418461489040101","319673650985324470133391415129032394452","144341530506010183333599235500716821018","49278945284522362513512276157546683389","129078828322242766157744059378519575736","28995880903155359770291047592393350448","40248016499411324772936725175663917177","85830320658122008453931200049403595609","137072781728853895650709960612190898863","219509552520569974583868360379305148190","304039564119088992804837457483142251692","144619208310535700653644465224373393455","185114827034937651856759847614992037655","228962712326204502214534772493765657497","176051746526868922004708321265090266966","201351983955584124501811455184160855453","9717702707779021863191611012024236828","43199056793610057593470496448828042193","6387626515404289903668457435571969384","178921450425415670519636632384688864145","196080506392537515488654746137652339829","34351323083193096245147860890525456216","134121993364193601747587344845061586518","332543323218532773519721895809380387312","165057652202163109821447694896803368600","239762466145717511716095682099779631116","322501024171695313234747172346106582517","309639282658930118807757630254151884911","204449800585054548665976681966719287518","229406716550729854616854281091187549102","154646946888285830375041585279800935383","130403767094565810059314586724407927819","229742653753630732464442005697011253097","331995379878877217878850897274991006390","169886523696035793676584177521827040463","326158733109933740054880516740051512951","234977086816461752370272038996644408562","232133542465668876511338012523769502509","288397624057430317718997494261702689139","325242640091815937285587536620593635395","130553713330864471846461556197186375429","229504831672449379676664202288999503218","167321859259145648050516547002004208569","57520888438582709270617047040213417495","218462915735236157791431207526385213565","60799445943604303072501754996526339645","122412311292082891844336300896486201644","205456425187426697100923213663666654715","49765367646455232078917279035073459284","80130330068159578638735865439939197065","315521241088836446456775058804680164436","65669592043857257360248864363185040550","102063872272642114647774797723170125883","275895958113250507901860690710246457359","122428424209887601494894338344224599765","257751835932933136622186542807896372935","305784875714126238500743948510862222467","129547477544933903033812222570515669753","15352954243688528104588705144441788556","144115131550790457788910321250686705876","49978805059545097954884005882458143256","23250451491765428539007771795079749346","152214101953756332536064471755266980175","197373848301137846789942809445978967177","130403767094565810059314586724407927819","196192752971554878422409343007146370882","161912795029919786466536487177815230373","313060015622709387875202425946162945281","102947552618209418802711564820465321146","145457683343268548700386219445880502576","280079081856563274202551860518015018526","211563150602212992110398059453408414483","199736824015900594826414012002118820382","176214915471096570480532147860006032354","31152260146556919759251662321424465188","184832668949504045014052529723378681893","263813225561990235673600640433482389857","267817553872908336145889358850062647820","32273153666901610190369914424465501245","27294903347538329529402148146838170769","191460036879827331686641467321804726056","322569136946990160170440770186660535129","236300839855015201227158373780934111304","102547778772310280041461417180563970666","58023291585700350463479550252972376958","105004090105507035888345514893264189628","229037425458627743139081883241966980319"],"threshold":0.9},"id":"CVE-2026-5246-3c9f116d","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"284887395322274163673066262777896413487","length":463},"id":"CVE-2026-5246-3d30d8c3","signature_type":"Function","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"mongoose.c","function":"mg_aes_gcm_decrypt"},"deprecated":false},{"source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"mongoose.c","function":"mg_http_parse"},"deprecated":false,"digest":{"function_hash":"169482835391483632511920415400433157767","length":2650},"id":"CVE-2026-5246-3eb57fc8","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"93212850972103637565164108427977558","length":903},"id":"CVE-2026-5246-479db182","signature_type":"Function","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"mongoose.c","function":"getpeer"}},{"signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"mongoose.c"},"deprecated":false,"digest":{"line_hashes":["56933431865281245213749287497782426521","303455783710560512343753439937641764898","303036824976635134908619449919295352721","124624454585074621904655830844712295340","6561407956898520786756777653896360563","294767461588999872490539531261252552715","23097913862147064676774561498425477377","306523893688106675536856035552690638391","243495406190095439628900850650457985285","317946814191474380836591343945907763614","314613284483198612553273371780820677253","49245216544456347606491959242059417274","116778585826418716170303821370250569511","336779140437804735905696204924253960839","288742116191864459027792656216763133013","274327277407508615029546726014812101136","332434401912874281430537741122661571567","96682559737486944154620655856227149850","186622395465038987129288798280409578170","310262615795520725550552141501401027813","90140572750714774861170194468280871621","9244300532616723394411416325184703516","19421017225838431121908650094444156603","324506443357838879115357657624328182267","264065705563480245840999412235584828772","26704613209502569353250967690759012161","225562100587811317871462542191747469555","67985329392020918420900606674817271804","97004733065197985112623089887963163096","259882351367768646477379968160817102341","143842239969820188343810213868778165631","73076231494370559425061270848247044790","19712610702678678138750778101373063399","2051417963277628477041207900031468320","193448156027838352693970725127156933391","67789153380471409382296741380926711709","116982958919005443406061642463119178464","28665900490105171143675497991351535105","325619045586590384971353053271400495031","322203366176116302694913581834816233959","144906567610331951298645834025178090357","275665191346582512226813004861224494875","72108969968671287165676073113908540097","260764798821274886585180251291715723352","311516043145510413929413847446881645078","33408407914328545099672704711216714115","180159965983064713659004726001301644810","75864077088983988380883324682721108431","283514182450017727361918624070024043260","174545628510337453787793780372496772280","169280853188626589078984246568509550670","249274382086140367465238988260062558767","283298895752339736303522186100799821953","309370920187928618663289771021288202439","40326253743574648834541450959435781468","168036368398611063048019074455283493565","142041783403648622183734022793455247935","337785171986507366427061745683328845438","200971470672070433806574787162350782981","246459084421158409508271879636616685473","178497673632907847985424603495005254580","147625765234870644987741089606512115234","125608274239893015702254416244430154117","106674142984676130989977692530078834796","317818015869759693059115042658936654867","249683910300377170747782883355612564449","130718674766101239475935730716936852871","250665637455326381798507422100577635451","181062300907135882941523102720798240188","198632693690028902544562145243396211538","272875052070693849567175882970796503685","174941304266970034908803404708417986504","325515677634887295009015740223415991206","240725051084142377963379210491230460651","47544155738714589444398018000181882915","151565062581388220393578371932084491774","176098472037468993123272496858262969410","108346869045048453734231298880138200202","189129425145615302855593228033943661238","284962362096635507392671394059090607698","240167769881959622628575733234518246276","283820486452260436020555651767874538701","210657630259912825272204683103627078739","81748695825459609641546607910337680488","150839986079736642515317212731311896185","147217562461486180854542751445272124903","135740491520311850831727720038686505364","330930823638739834615971735556405304892","90808821232669300321627953952310089261","297100237347864914058579389636219061668","185558195117700871259561021492392876903","138945797621036858455502679664416451494","295859711013190854541264736561792026554","186946175742719696572222920641736691621","80563253276249374257502444141571543685","268898602923381710079666002836502702604","54008277736932128131107790654075355512","46446964086344257330151622362710422138","294088950994057299953349670765794449815","277815336795832074581049057704211114881","310195857280588516826327302251308476623","247067085422557109988189947515934599102","313811670961247816809835158680447031175","321039469075947274274862094326940937842","149204095977579775158569319523296377014","37415825601299739301022543248796799547","222981842113018445298086962150850787644","227108120022272002364766608411054073442","305162833108134619902342219290277501935","58964711037780293404320652355226086804","9437876396204833801476030157924316578","506666656578193056911612979893655164","46148227840654825310039885552784555514","51486828226111308951402893970210295231","264778674555001533239524250037403968916","270184295426408907650816603346375894996","215483416289239105373085481951564675827","104522920709814054877500805439768270288","144422475653927737875015228092684653629","322158298067059941551515647401405828285","64138746259907601956727958666149641080","178740577980772207894443934468463984962","105092733098238568528332336540088977162","214107427827052325797984003184624248193","69851016955281771236625038635337133031","339531381409716696330867507336020855523","65435455913219771565833736959607063610","111243338608708823626753390781387202342","115240527536752730628919954176480783101","106631365053193492567279455858649416064","280098514755188230095378998464723237835","99618655361699004483939623708081829375","4360123043167917805668550763739904861","279479400312961436471337999409879455622","106877907065056045032335256425728047154","17414785322227276591322205728357532476","197373848301137846789942809445978967177","130403767094565810059314586724407927819","196192752971554878422409343007146370882","161912795029919786466536487177815230373","313060015622709387875202425946162945281","102947552618209418802711564820465321146","145457683343268548700386219445880502576","183620710663677804024233103701738885573","89907086326744855360949479765887958690","291312107145074695395514728944773432558","136753443340113592476679800288972712523","153727050990137812601449015336433060","197373848301137846789942809445978967177","130403767094565810059314586724407927819","255997722559097574620098256938064459576","68441160989040999281218388098010292829","176364859884227006479435786866928776958","201970721734579392239978390934633053295","151903328359582460231684335964360945870","59784093424306230654489344977207941672","20459915730428632493000693870709414169","336891102694408727580294786460490492846","253066278568950610856613401423838628589","288519642934558429790274657646736142116","192950257664883424999665004016645343714","227692618715369704900486678700455716040","119835196798782698214675597940995916024","149959037209250504984573260640700311401","53440401303995629403167703346471190787","119937427392194843040101836720800183858","198651752223389311820485040931269337192","182843108111491156423179287511188709866","308096605264013075853203281581807228145","325664619094998110495016418461489040101","319673650985324470133391415129032394452","144341530506010183333599235500716821018","49278945284522362513512276157546683389","129078828322242766157744059378519575736","28995880903155359770291047592393350448","40248016499411324772936725175663917177","85830320658122008453931200049403595609","137072781728853895650709960612190898863","219509552520569974583868360379305148190","304039564119088992804837457483142251692","144619208310535700653644465224373393455","185114827034937651856759847614992037655","228962712326204502214534772493765657497","176051746526868922004708321265090266966","201351983955584124501811455184160855453","9717702707779021863191611012024236828","43199056793610057593470496448828042193","6387626515404289903668457435571969384","178921450425415670519636632384688864145","196080506392537515488654746137652339829","34351323083193096245147860890525456216","134121993364193601747587344845061586518","332543323218532773519721895809380387312","165057652202163109821447694896803368600","239762466145717511716095682099779631116","322501024171695313234747172346106582517","309639282658930118807757630254151884911","204449800585054548665976681966719287518","229406716550729854616854281091187549102","154646946888285830375041585279800935383","130403767094565810059314586724407927819","229742653753630732464442005697011253097","331995379878877217878850897274991006390","169886523696035793676584177521827040463","326158733109933740054880516740051512951","234977086816461752370272038996644408562","232133542465668876511338012523769502509","288397624057430317718997494261702689139","325242640091815937285587536620593635395","130553713330864471846461556197186375429","229504831672449379676664202288999503218","167321859259145648050516547002004208569","57520888438582709270617047040213417495","218462915735236157791431207526385213565","60799445943604303072501754996526339645","122412311292082891844336300896486201644","205456425187426697100923213663666654715","49765367646455232078917279035073459284","80130330068159578638735865439939197065","315521241088836446456775058804680164436","65669592043857257360248864363185040550","102063872272642114647774797723170125883","275895958113250507901860690710246457359","122428424209887601494894338344224599765","257751835932933136622186542807896372935","305784875714126238500743948510862222467","129547477544933903033812222570515669753","15352954243688528104588705144441788556","144115131550790457788910321250686705876","49978805059545097954884005882458143256","23250451491765428539007771795079749346","152214101953756332536064471755266980175","197373848301137846789942809445978967177","130403767094565810059314586724407927819","196192752971554878422409343007146370882","161912795029919786466536487177815230373","313060015622709387875202425946162945281","102947552618209418802711564820465321146","145457683343268548700386219445880502576","280079081856563274202551860518015018526","211563150602212992110398059453408414483","199736824015900594826414012002118820382","176214915471096570480532147860006032354","31152260146556919759251662321424465188","184832668949504045014052529723378681893","263813225561990235673600640433482389857","267817553872908336145889358850062647820","32273153666901610190369914424465501245","27294903347538329529402148146838170769","191460036879827331686641467321804726056","322569136946990160170440770186660535129","236300839855015201227158373780934111304","102547778772310280041461417180563970666","58023291585700350463479550252972376958","105004090105507035888345514893264189628","229037425458627743139081883241966980319","339994179691324067704548755171150621086","292816727867213137241220607084019249881","115163519840789643773573514817908554262","52656032325957364131554071512861025468","168726446307564999387028906064870247981","164393121173833428582681818186604154089","128840611111896029413418295319592257290","117919650635928773786702254063542722384","331748457844263975774843423516844136484","10299790149863837467398885079323728634","133031934407816907640259478827773757363","127727766903060323082876207448424436262","332627427076818448656501346353500451857","197271039286460923839245118406935146943","280530562517149823643776051246068845765","232121593093810813270917944440099007756","146050256032827791610710580688900516071","329505966588041481371488711060843801039","139943472294742398921276591779247270454","211630267777897024369314983351812191669","143121139624474137479755660008422789602","278545133255467574925410929694638865755","34493112195234884334933821281064781200","148610498549762889717004973256217423141","113651584397507884552203427338154868104","249469841276797515693095052882972063250","227981912956658099610886095835513324290","4013314329601652871938402301567531850","127688218017202541856626972076064578951","268448129425082683312835155095326730006","278675231599958880132844965898593265451","145391048498550237254294328942577741054","175785920547605025903083673681931507177","112887602175785218215727790862607116977","211501764689793163843921429535111953433","56192890385092876449122461616572299313","180166381661433559618913587768413906166","86671909889508757942757906751299464277","288685814597346261261024784673007913377","208540302627622567701609919381829610627","308973565140169985853590614608832626669","340177776924663054721258530754734619376","141898069335864065341824762355327147084","163478267167680265790633447886385166179","172266484631433410678996138377744150275","288408347785360325098529331447392584828","299804082750032730164740057256852684493","317889136142439194457672805800554329256","11198144294321269404455436663924387432","188406693863049931447102968283248071383","82640399190652379891482606387304947109","261467906350646052955097477097071774313","224579684604879701433326967871115585145","218738675711252010320321931948940263807","267399372645606655407081159165455612008","306669156786746193942396316066334355421","148075135791548817664381439903438766335","293665662732071792121171071094380571570","295230499844304224415280077334956472484","212486963107155032308919581914730950630","80979985351413094348471070095489128866","330462188675994544967312945304748867699","179557291430156444174196948696794994927","23408693580845899365845328933754551603","219548503678408471025861847291671100948","295230499844304224415280077334956472484","238514820134418407276834849572934856498","120151478661977389860112505950148286347","126637918579228009693165287988171011937","329940228525569355667064047676155503160","138964223778760859751683698195611113395","109697911010499671605364282942207118731","286718235630277074047459233258413272978","128196217974659585650278628768051761342","58193428203198968228937992105361911181","168835970645394128340244412430549740145","148448165703134266156797568887494611204","111699303742315830928980711537758271661","274994703168481489445931894695666404524","42320537998981901654273763762274420190","251553503147214024625448007237643122058","227786675809996272858477768582552330852","141678746247591748580920649705550734869","188842102269008906478609187553341740047","125171629189675101503180477527288853850","258831572389871075508268819855872135361","67502928094642593500731059722146586324","265734769265306628708510081328851984075","241265352231720069307040971674185507195","157263359436730301174576694286622566290"],"threshold":0.9},"id":"CVE-2026-5246-47c17c8f","signature_type":"Line"},{"target":{"file":"src/net_builtin.c","function":"rx_tcp"},"deprecated":false,"digest":{"function_hash":"4701345775393380708352978062411143252","length":2644},"id":"CVE-2026-5246-4af02874","signature_type":"Function","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"},{"deprecated":false,"digest":{"function_hash":"102027882861119357625942818285383242107","length":561},"id":"CVE-2026-5246-50e79370","signature_type":"Function","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"src/net_builtin.c","function":"handle_opt"}},{"target":{"file":"test/unit_test.c"},"deprecated":false,"digest":{"line_hashes":["20333685831321025613166579583783134420","193612862579461182524916428303822579161","99129684687679978660615210059742279119","250756933803491156136098182880977834173","328383317207347260532997482585937157429","289240339120596722481479293259450469038","120519121627839656708195254305511516996","193211685255284766619601582133415552597","130893935940066303983165677155287350090","79920726599156702382919114007541284764","170530877469794623609660069260444607947","217028554964648763586556222942173612783","126590371730607760672704040885470524591","79212480672582253977130130603176271528","314607484840485571386936771021675918807","160483758676961072924155259067019991021","101591178555718284102179748474383516499","192204867219150616545108262507762865232","269493921300421210455410426748437311014","191887931081936735754045701036845515850","215353401790119557842054580333880151458","274858323439496321889267435296779444944","245789429505172758703916825018579785587","215476942944667489248699465179379716455","299127029378326229344656533318629854904","112523351408874232190272767023163918444","308819560484716367285777914200762289331","254015166745900496756362862017071544865","56370731530181509523154633403694197395","97614217446518582519325337318855980108","26800918742382487293809557237094075798","278452137593383677734156677900770567058","254760518657760757061551376044374745251","311524444728454269983667260141592642015"],"threshold":0.9},"id":"CVE-2026-5246-54c04dd4","signature_type":"Line","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"},{"id":"CVE-2026-5246-58e78bce","signature_type":"Function","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"src/json.c","function":"mg_atod"},"deprecated":false,"digest":{"function_hash":"98473589217372199762288786176251205173","length":1158}},{"id":"CVE-2026-5246-598ff68c","signature_type":"Function","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"mongoose.c","function":"mg_tls_recv_cert"},"deprecated":false,"digest":{"function_hash":"32210455910707166939160950749999725372","length":2871}},{"id":"CVE-2026-5246-5f17633d","signature_type":"Function","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"mongoose.c","function":"mg_match"},"deprecated":false,"digest":{"function_hash":"1106225861595394964441040414951427332","length":1414}},{"id":"CVE-2026-5246-6356028e","signature_type":"Function","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"mongoose.c","function":"mg_tls_recv_record"},"deprecated":false,"digest":{"function_hash":"63904093970639459445221502944134231697","length":2376}},{"signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"src/tls_aes128.c","function":"mg_aes_gcm_decrypt"},"deprecated":false,"digest":{"function_hash":"284887395322274163673066262777896413487","length":463},"id":"CVE-2026-5246-637dc058","signature_type":"Function"},{"digest":{"function_hash":"187577387590304492909851653472231242198","length":995},"id":"CVE-2026-5246-63c29e72","signature_type":"Function","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"mongoose.c","function":"mg_http_parse_headers"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["272875052070693849567175882970796503685","174941304266970034908803404708417986504","325515677634887295009015740223415991206","240725051084142377963379210491230460651","47544155738714589444398018000181882915","151565062581388220393578371932084491774","176098472037468993123272496858262969410","108346869045048453734231298880138200202","189129425145615302855593228033943661238","284962362096635507392671394059090607698","240167769881959622628575733234518246276","283820486452260436020555651767874538701","210657630259912825272204683103627078739","81748695825459609641546607910337680488","150839986079736642515317212731311896185","147217562461486180854542751445272124903","135740491520311850831727720038686505364","330930823638739834615971735556405304892","90808821232669300321627953952310089261","297100237347864914058579389636219061668","185558195117700871259561021492392876903","138945797621036858455502679664416451494","295859711013190854541264736561792026554","186946175742719696572222920641736691621","80563253276249374257502444141571543685","268898602923381710079666002836502702604","54008277736932128131107790654075355512","46446964086344257330151622362710422138","294088950994057299953349670765794449815","277815336795832074581049057704211114881"],"threshold":0.9},"id":"CVE-2026-5246-69b0c7ea","signature_type":"Line","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"src/net_builtin.c"}},{"source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"src/tls_builtin.c","function":"mg_tls_verify_cert_signature"},"deprecated":false,"digest":{"function_hash":"287623028034891712639184224292359152562","length":1609},"id":"CVE-2026-5246-7f4a98cf","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"mongoose.c","function":"handle_mdns_query"},"deprecated":false,"digest":{"function_hash":"234094490269337275516703077143475779957","length":4366},"id":"CVE-2026-5246-859b9d67"},{"id":"CVE-2026-5246-86621c5d","signature_type":"Function","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"function":"mg_tls_verify_cert_signature","file":"mongoose.c"},"deprecated":false,"digest":{"function_hash":"287623028034891712639184224292359152562","length":1609}},{"deprecated":false,"digest":{"function_hash":"136434909164675821244055820884942362870","length":3203},"id":"CVE-2026-5246-87f25262","signature_type":"Function","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"src/http.c","function":"http_cb"}},{"signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"src/tls_chacha20.h"},"deprecated":false,"digest":{"line_hashes":["280855450986332431349085604423316739658","122190681113740699764637444879838689335","165051664506154873312422487797586602076","15281729727765618144000334521435940646"],"threshold":0.9},"id":"CVE-2026-5246-8d532ee5","signature_type":"Line"},{"target":{"file":"test/unit_test.c","function":"test_json"},"deprecated":false,"digest":{"function_hash":"265107008410084495864201209337354819365","length":9598},"id":"CVE-2026-5246-8ecd5dba","signature_type":"Function","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"},{"target":{"file":"mongoose.c","function":"handle_opt"},"deprecated":false,"digest":{"function_hash":"102027882861119357625942818285383242107","length":561},"id":"CVE-2026-5246-90ad0c61","signature_type":"Function","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"},{"deprecated":false,"digest":{"line_hashes":["207974650526094451157021192520569915708","323347896560934645970690655083833005015"],"threshold":0.9},"id":"CVE-2026-5246-94fe542e","signature_type":"Line","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"src/tls_aes128.h"}},{"deprecated":false,"digest":{"function_hash":"136434909164675821244055820884942362870","length":3203},"id":"CVE-2026-5246-98f676c9","signature_type":"Function","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"mongoose.c","function":"http_cb"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"src/http.c","function":"mg_http_parse_headers"},"deprecated":false,"digest":{"function_hash":"187577387590304492909851653472231242198","length":995},"id":"CVE-2026-5246-9f8a2fa3"},{"source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"src/dns.c"},"deprecated":false,"digest":{"line_hashes":["56933431865281245213749287497782426521","303455783710560512343753439937641764898","303036824976635134908619449919295352721","124624454585074621904655830844712295340","6561407956898520786756777653896360563","294767461588999872490539531261252552715","23097913862147064676774561498425477377","306523893688106675536856035552690638391","243495406190095439628900850650457985285","317946814191474380836591343945907763614","314613284483198612553273371780820677253","49245216544456347606491959242059417274","116778585826418716170303821370250569511","336779140437804735905696204924253960839","288742116191864459027792656216763133013","274327277407508615029546726014812101136","332434401912874281430537741122661571567","96682559737486944154620655856227149850","186622395465038987129288798280409578170","310262615795520725550552141501401027813","90140572750714774861170194468280871621","9244300532616723394411416325184703516","19421017225838431121908650094444156603","324506443357838879115357657624328182267","264065705563480245840999412235584828772","26704613209502569353250967690759012161","225562100587811317871462542191747469555","67985329392020918420900606674817271804","97004733065197985112623089887963163096","259882351367768646477379968160817102341","143842239969820188343810213868778165631","73076231494370559425061270848247044790","19712610702678678138750778101373063399","2051417963277628477041207900031468320","193448156027838352693970725127156933391","67789153380471409382296741380926711709","116982958919005443406061642463119178464","28665900490105171143675497991351535105","325619045586590384971353053271400495031","322203366176116302694913581834816233959","144906567610331951298645834025178090357","275665191346582512226813004861224494875"],"threshold":0.9},"id":"CVE-2026-5246-9fd54074","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"169482835391483632511920415400433157767","length":2650},"id":"CVE-2026-5246-a000cf20","signature_type":"Function","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"src/http.c","function":"mg_http_parse"}},{"deprecated":false,"digest":{"function_hash":"96597121965754134514680542877790556858","length":8574},"id":"CVE-2026-5246-acb7a5f1","signature_type":"Function","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"function":"test_http_parse","file":"test/unit_test.c"}},{"id":"CVE-2026-5246-ad404643","signature_type":"Function","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"test/unit_test.c","function":"test_match"},"deprecated":false,"digest":{"function_hash":"221798542524307238494815944612857726953","length":5807}},{"signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"src/tls_builtin.c","function":"mg_tls_recv_cert"},"deprecated":false,"digest":{"function_hash":"32210455910707166939160950749999725372","length":2871},"id":"CVE-2026-5246-ade72e58","signature_type":"Function"},{"digest":{"line_hashes":["207974650526094451157021192520569915708","323347896560934645970690655083833005015","281221804496464306984686811210240126495","36809931901419678819901745737242605307","280855450986332431349085604423316739658","122190681113740699764637444879838689335","165051664506154873312422487797586602076","15281729727765618144000334521435940646"],"threshold":0.9},"id":"CVE-2026-5246-af182062","signature_type":"Line","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"mongoose.h"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"mongoose.c","function":"mg_atod"},"deprecated":false,"digest":{"function_hash":"98473589217372199762288786176251205173","length":1158},"id":"CVE-2026-5246-be9c54da","signature_type":"Function"},{"id":"CVE-2026-5246-d2786e11","signature_type":"Line","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"src/tls_chacha20.c"},"deprecated":false,"digest":{"line_hashes":["86671909889508757942757906751299464277","288685814597346261261024784673007913377","208540302627622567701609919381829610627","308973565140169985853590614608832626669","340177776924663054721258530754734619376","141898069335864065341824762355327147084","163478267167680265790633447886385166179","172266484631433410678996138377744150275","288408347785360325098529331447392584828","299804082750032730164740057256852684493","317889136142439194457672805800554329256","11198144294321269404455436663924387432","188406693863049931447102968283248071383","82640399190652379891482606387304947109","261467906350646052955097477097071774313","224579684604879701433326967871115585145","218738675711252010320321931948940263807","267399372645606655407081159165455612008","306669156786746193942396316066334355421","148075135791548817664381439903438766335","293665662732071792121171071094380571570","295230499844304224415280077334956472484","212486963107155032308919581914730950630","80979985351413094348471070095489128866","330462188675994544967312945304748867699","179557291430156444174196948696794994927","23408693580845899365845328933754551603","219548503678408471025861847291671100948","295230499844304224415280077334956472484","238514820134418407276834849572934856498","120151478661977389860112505950148286347","126637918579228009693165287988171011937","329940228525569355667064047676155503160","138964223778760859751683698195611113395","109697911010499671605364282942207118731","286718235630277074047459233258413272978","128196217974659585650278628768051761342","58193428203198968228937992105361911181","168835970645394128340244412430549740145","148448165703134266156797568887494611204","111699303742315830928980711537758271661","274994703168481489445931894695666404524","42320537998981901654273763762274420190","251553503147214024625448007237643122058","227786675809996272858477768582552330852","141678746247591748580920649705550734869","188842102269008906478609187553341740047","125171629189675101503180477527288853850","258831572389871075508268819855872135361","67502928094642593500731059722146586324","265734769265306628708510081328851984075","241265352231720069307040971674185507195","157263359436730301174576694286622566290"],"threshold":0.9}},{"id":"CVE-2026-5246-dc185e68","signature_type":"Function","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"src/str.c","function":"mg_match"},"deprecated":false,"digest":{"function_hash":"1106225861595394964441040414951427332","length":1414}},{"signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"src/tls_builtin.c"},"deprecated":false,"digest":{"line_hashes":["339994179691324067704548755171150621086","292816727867213137241220607084019249881","115163519840789643773573514817908554262","52656032325957364131554071512861025468","168726446307564999387028906064870247981","164393121173833428582681818186604154089","128840611111896029413418295319592257290","117919650635928773786702254063542722384","331748457844263975774843423516844136484","10299790149863837467398885079323728634","133031934407816907640259478827773757363","127727766903060323082876207448424436262","332627427076818448656501346353500451857","197271039286460923839245118406935146943","280530562517149823643776051246068845765","232121593093810813270917944440099007756","146050256032827791610710580688900516071","329505966588041481371488711060843801039","139943472294742398921276591779247270454","211630267777897024369314983351812191669","143121139624474137479755660008422789602","278545133255467574925410929694638865755","34493112195234884334933821281064781200","148610498549762889717004973256217423141","113651584397507884552203427338154868104","249469841276797515693095052882972063250","227981912956658099610886095835513324290","4013314329601652871938402301567531850","127688218017202541856626972076064578951","268448129425082683312835155095326730006","278675231599958880132844965898593265451","145391048498550237254294328942577741054","175785920547605025903083673681931507177","112887602175785218215727790862607116977","211501764689793163843921429535111953433","56192890385092876449122461616572299313","180166381661433559618913587768413906166"],"threshold":0.9},"id":"CVE-2026-5246-e7b4a2fe","signature_type":"Line"},{"source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1","target":{"file":"src/tls_chacha20.c","function":"mg_chacha20_poly1305_decrypt"},"deprecated":false,"digest":{"length":359,"function_hash":"214187038073003652483917653332949765372"},"id":"CVE-2026-5246-e910175b","signature_type":"Function","signature_version":"v1"},{"target":{"file":"mongoose.c","function":"rx_tcp"},"deprecated":false,"digest":{"function_hash":"4701345775393380708352978062411143252","length":2644},"id":"CVE-2026-5246-f8e1d0a2","signature_type":"Function","signature_version":"v1","source":"https://github.com/cesanta/mongoose/commit/0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5246.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}]}