CVE-2026-6986
Full vulnerability record from the local CVENow database.
Description
A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This issue affects the function mg_aes_gcm_decrypt of the file /src/tls_aes128.c of the component GCM Authentication Tag Handler. Such manipulation leads to improper verification of cryptographic signature. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 7.21 is capable of addressing this issue. It is advisable to upgrade the affected component. VulDB has contacted the vendor early and they confirmed quickly, that this issue got fixed already.
Severity
LOW
CVSS score
2.9
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-04-25 17:16:33.700000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
"id": "CVE-2026-6986",
"sourceIdentifier": "[email protected]",
"published": "2026-04-25T17:16:33.700",
"lastModified": "2026-10-26T21:10:00.170",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This issue affects the function mg_aes_gcm_decrypt of the file /src/tls_aes128.c of the component GCM Authentication Tag Handler. Such manipulation leads to improper verification of cryptographic signature. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The exploit has been disclosed publicly and may be used. Upgrading to version 7.21 is capable of addressing this issue. It is advisable to upgrade the affected component. VulDB has contacted the vendor early and they confirmed quickly, that this issue got fixed already."
},
{
"lang": "es",
"value": "Una vulnerabilidad de seguridad ha sido detectada en Cesanta Mongoose hasta la versión 7.20. Este problema afecta a la función mg_aes_gcm_decrypt del archivo /src/tls_aes128.c del componente Gestor de Etiquetas de Autenticación GCM. Dicha manipulación conduce a una verificación incorrecta de la firma criptográfica. El ataque puede ser realizado de forma remota. Un alto nivel de complejidad está asociado con este ataque. La explotabilidad se evalúa como difícil. El exploit ha sido divulgado públicamente y puede ser utilizado. La actualización a la versión 7.21 es capaz de solucionar este problema. Es aconsejable actualizar el componente afectado. VulDB contactó al proveedor con antelación y ellos confirmaron rápidamente que este problema ya fue solucionado."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Cesanta",
"product": "Mongoose",
"cpes": [
"cpe:2.3:a:cesanta:mongoose:*:*:*:*:*:*:*:*"
],
"modules": [
"GCM Authentication Tag Handler"
],
"versions": [
{
"version": "7.0",
"status": "affected"
},
{
"version": "7.1",
"status": "affected"
},
{
"version": "7.2",
"status": "affected"
},
{
"version": "7.3",
"status": "affected"
},
{
"version": "7.4",
"status": "affected"
},
{
"version": "7.5",
"status": "affected"
},
{
"version": "7.6",
"status": "affected"
},
{
"version": "7.7",
"status": "affected"
},
{
"version": "7.8",
"status": "affected"
},
{
"version": "7.9",
"status": "affected"
},
{
"version": "7.10",
"status": "affected"
},
{
"version": "7.11",
"status": "affected"
},
{
"version": "7.12",
"status": "affected"
},
{
"version": "7.13",
"status": "affected"
},
{
"version": "7.14",
"status": "affected"
},
{
"version": "7.15",
"status": "affected"
},
{
"version": "7.16",
"status": "affected"
},
{
"version": "7.17",
"status": "affected"
},
{
"version": "7.18",
"status": "affected"
},
{
"version": "7.19",
"status": "affected"
},
{
"version": "7.20",
"status": "affected"
},
{
"version": "7.21",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 2.9,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 3.7,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.2,
"impactScore": 1.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"baseScore": 2.6,
"accessVector": "NETWORK",
"accessComplexity": "HIGH",
"authentication": "NONE",
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"availabilityImpact": "NONE"
},
"baseSeverity": "LOW",
"exploitabilityScore": 4.9,
"impactScore": 2.9,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-27T13:33:26.520467Z",
"id": "CVE-2026-6986",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-345"
},
{
"lang": "en",
"value": "CWE-347"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:cesanta:mongoose:*:*:*:*:*:*:*:*",
"versionStartIncluding": "7.0",
"versionEndExcluding": "7.21",
"matchCriteriaId": "CFB6060D-2132-492F-8C8D-CC053CCFBC80"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/cesanta/mongoose/releases/tag/7.21",
"source": "[email protected]",
"tags": [
"Release Notes"
]
},
{
"url": "https://github.com/dwBruijn/CVEs/blob/main/Mongoose/AESGCM.md",
"source": "[email protected]",
"tags": [
"Exploit",
"Third Party Advisory"
]
},
{
"url": "https://vuldb.com/submit/796231",
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/vuln/359529",
"source": "[email protected]",
"tags": [
"Third Party Advisory",
"VDB Entry"
]
},
{
"url": "https://vuldb.com/vuln/359529/cti",
"source": "[email protected]",
"tags": [
"Permissions Required",
"VDB Entry"
]
}
]
}