CVE-2026-6986

Red Hat statement

Red Hat rates this vulnerability as Low impact with a CVSS score of 3.7. No Red Hat supported products ship the Cesanta Mongoose library, and the only affected packages are community ones. The vulnerability is specific to Mongoose's built-in TLS implementation, commonly used in embedded and IoT deployments whilst on Linux distributions applications tend to build against OpenSSL or mbedTLS which are not affected. Even where built-in TLS is in use, an attacker would need an active man-in-the-middle position on the network and prior knowledge of the plaintext layout at specific byte offsets to tamper with data in transit. The impact is limited to integrity within a single TLS session, with no effect on confidentiality or availability.

Red Hat mitigation

If you are compiling Mongoose from source, build it against OpenSSL or mbedTLS instead of the built-in TLS stack by setting MG_TLS=MG_TLS_OPENSSL or MG_TLS=MG_TLS_MBED. For applications where switching TLS backends is not an option, restricting network access to the Mongoose service reduces the risk of a man-in-the-middle attack reaching the vulnerable code path.