Mongoose Library Flaws Expose Devices to RCE and mTLS Bypass: Update to Version 7.21+ to Mitigate Risks

Three critical vulnerabilities affect Mongoose versions ≤ 7.20 and enable pre-authentication RCE and mTLS bypass.

CVE-2026-5244 is a heap overflow in mg_tls_recv_cert that can enable arbitrary code execution.

CVE-2026-5245 is a stack overflow in mDNS processing that can enable RCE, and CVE-2026-5246 allows forged P-384 keys to bypass mTLS.

Operators should upgrade affected devices to Mongoose 7.21 or later and audit firmware and exposed services.

Exploitation can be performed via exposed services such as HTTPS or MQTT, enabling device takeover and data exfiltration.