Key points
- Mongoose versions before 7.23 contain a high-severity memory corruption flaw.
- The issue affects systems using PPP or PPPoE with IPv6 and TCP/IP enabled.
- Version 7.23 fixes the vulnerability by addressing the length field issue.
Mongoose web server versions prior to 7.23 are affected by a high-severity vulnerability. According to the National Vulnerability Database, this flaw allows an unauthenticated adjacent peer to trigger out-of-bounds memory access. The issue exists in the `ppp_handle_ipv6cp()` function within the source file `src/l2_ppp.c`. This component fails to verify the sixteen-bit IPv6 Control Protocol length field against the actual size of the received payload.
In plain English
The software trusts a number sent by a connected device without checking if it matches the real data size. An attacker on the same network can send a short request that claims to be very long. The server then reads memory beyond its intended buffer and writes data past its own storage limits. This behavior can expose adjacent heap memory bytes or cause the event loop to hang indefinitely.
The background
This vulnerability requires specific configuration settings to be exploitable. The system must have `MG_ENABLE_TCPIP` and `MG_ENABLE_IPV6` enabled. An attacker must first complete the standard Link Control Protocol exchange. Once that connection is established, the peer can send a Configure-Request with an oversized length value. This triggers the unsafe memory operations in the transmission queue.
What changes now
Version 7.23 of the Mongoose library addresses this issue. The source material states that this issue is fixed in version 7.23. Users running any version older than 7.23 should upgrade immediately to eliminate this exposure. No other patches or mitigations are mentioned in the record.
Who needs to act first
Teams usually prioritize systems exposed to untrusted networks or external peers. Check whether your infrastructure uses PPP or PPPoE connections with IPv6 support enabled. Update these critical assets before internal-only systems. Test the new library version in a staging environment to ensure compatibility with your applications. Back up current configurations before applying the update. Monitor logs for unusual connection attempts during the transition period.
What to do and how to stay safe: Mongoose
- Verify if your applications use Mongoose versions older than 7.23.
- Confirm that PPP or PPPoE links are not enabled with IPv6 support.
- Upgrade to version 7.23 as soon as possible to apply the fix.
- Monitor network traffic for anomalous PPP negotiation attempts post-update.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-63626?
The National Vulnerability Database rates this vulnerability as 8.8, which is classified as HIGH severity.
Which specific function contains the vulnerability?
The flaw is located in the `ppp_handle_ipv6cp()` function within the `src/l2_ppp.c` source file.
Is a fix available for this issue?
Yes, the issue is fixed in Mongoose version 7.23.
