Mongoose: Out-of-bounds read and heap overflow in PPP IPv6CP option parsing
Summary
Mongoose, an embedded web server and network library, does not validate the 16-bit length field of IPv6CP Configure-Request packets against the received payload size. An unauthenticated peer on the same PPP or PPPoE link can send a short packet with an oversized length, which can lead to out-of-bounds reads, heap overflow writes, exposure of adjacent heap bytes, or a hang of the event loop. The issue only affects builds using the built-in TCP/IP stack with MG_ENABLE_TCPIP and MG_ENABLE_IPV6 on PPP or PPPoE links.
Affected
- Mongoose versions prior to 7.23
- Only builds with MG_ENABLE_TCPIP and MG_ENABLE_IPV6 on PPP or PPPoE links
Fixed in
- Mongoose 7.23 (commit 751f14742dea934bec08a507ab1fecc3673d4903)
Workaround
- Unknown. No vendor workaround published.
Exploitation
- Not listed in CISA KEV.
- EPSS 0.00239 (low).
- Public proof of concept: unknown.
- Exploited in the wild: no evidence found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Check whether any device firmware or product embeds Mongoose and uses PPP or PPPoE with IPv6.
- Ask device vendors whether their firmware ships Mongoose 7.23 or later.
- Update affected firmware or Mongoose builds to 7.23 or later.
- Until patched, restrict PPP/PPPoE access segments to trusted parties and monitor them for malformed PPP traffic.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-pc66-j6r6-49x9 github.com
- Fix commit 751f147 github.com
- Mongoose 7.23 release github.com
- OSV CVE-2026-63626 osv.dev
- OpenCVE CVE-2026-63626 app.opencve.io
- Debian Security Tracker CVE-2026-63626 security-tracker.debian.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:38.
Original description (NVD)
Mongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MG_ENABLE_TCPIP and MG_ENABLE_IPV6, an unauthenticated adjacent peer can complete the required LCP exchange and send a short Configure-Request with an oversized length, causing ppp_tx_frame() to read beyond recv_queue.buf and write beyond tx.buf. The same length misuse can also expose adjacent heap bytes in a reply or hang the event loop through find_opt(). This issue is fixed in version 7.23.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.