How severe is CVE-2024-42385?

CVE-2024-42385 has a CVSS 3.x base score of 4.0, rated medium severity. It is exploitable over local access with high attack complexity, requires high privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2024-42385 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (1st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-42385?

CVE-2024-42385 affects Cesanta Mongoose. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-42385?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-42385 have an EU (EUVD) identifier?

Yes. CVE-2024-42385 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-39589.

When was CVE-2024-42385 published?

CVE-2024-42385 was published on 2024-11-18 and last updated on 2026-06-17.

CVE-2024-42385

CVE-2024-42385 is a medium-severity vulnerability in Cesanta Mongoose with a CVSS 3.x base score of 4.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-140.

Key facts

Severity: Medium (CVSS 3.x base score 4.0)
EPSS exploit prediction: 0% (1st percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-39589
Weakness: CWE-140
Affected product: Cesanta Mongoose
Published: 2024-11-18
Last modified: 2026-06-17

Description

Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an out-of-bound memory write if the PEM certificate contains unexpected characters.

Frequently asked questions

What is CVE-2024-42385?: Improper Neutralization of Delimiters vulnerability in Cesanta Mongoose Web Server v7.14 allows to trigger an out-of-bound memory write if the PEM certificate contains unexpected characters.
How severe is CVE-2024-42385?: CVE-2024-42385 has a CVSS 3.x base score of 4.0, rated medium severity. It is exploitable over local access with high attack complexity, requires high privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2024-42385 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (1st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-42385?: CVE-2024-42385 affects Cesanta Mongoose. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-42385?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-42385 have an EU (EUVD) identifier?: Yes. CVE-2024-42385 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-39589.
When was CVE-2024-42385 published?: CVE-2024-42385 was published on 2024-11-18 and last updated on 2026-06-17.

References

https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-42385

Affected products (1)

cpe:2.3:a:cesanta:mongoose:*:*:*:*:*:*:*:*

More vulnerabilities in Cesanta Mongoose

CVE-2022-25299 — Critical (CVSS 9.8): This affects the package cesanta/mongoose before 7.6. The unsafe handling of file names during upload using…
CVE-2020-25756 — Critical (CVSS 9.8): A buffer overflow vulnerability exists in the mg_get_http_header function in Cesanta Mongoose 6.18 due to a lack of…
CVE-2019-19307 — Critical (CVSS 9.8): An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS…
CVE-2019-12951 — Critical (CVSS 9.8): An issue was discovered in Mongoose before 6.15. The parse_mqtt() function in mg_mqtt.c has a critical heap-based…
CVE-2018-20356 — Critical (CVSS 9.8): An invalid read of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in…
CVE-2018-20355 — Critical (CVSS 9.8): An invalid write of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in…

All CVEs affecting Cesanta Mongoose →

Other CWE-140 vulnerabilities

CVE-2025-32918 — High (CVSS 8.8): Improper neutralization of Livestatus command delimiters in autocomplete endpoint within the RestAPI of Checkmk…
CVE-2024-38865 — High (CVSS 8.8): Improper neutralization of livestatus command delimiters in a specific endpoint within RestAPI of Checkmk prior to…
CVE-2025-47779 — High (CVSS 7.7): Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of…
CVE-2026-33456 — High (CVSS 7.6): Livestatus injection in the notification test mode in Checkmk <2.5.0b4 and <2.4.0p26 allows an authenticated user with…
CVE-2023-6157 — High (CVSS 7.6): Improper neutralization of livestatus command delimiters in ajax_search in Checkmk <= 2.0.0p39, < 2.1.0p37, and <…
CVE-2023-6156 — High (CVSS 7.6): Improper neutralization of livestatus command delimiters in the availability timeline in Checkmk <= 2.0.0p39, <…

Browse all CWE-140 vulnerabilities →