CVE-2026-5244

CVE-2026-5244 describes a high-severity heap-based buffer overflow vulnerability affecting Cesanta Mongoose versions up to 7.20, specifically in the TLS 1.3 Handler's mg_tls_recv_cert function. This flaw can be exploited remotely without authentication or user interaction, potentially leading to low impacts on confidentiality, integrity, and availability. The exploit has been publicly disclosed and is considered active, with community discussions highlighting potential for pre-authentication Remote Code Execution. Given the public availability of exploit details, immediate upgrade to Mongoose version 7.21 is strongly recommended to mitigate this critical risk.