# CVE-2026-63626: Mongoose IPv6CP length field bounds check buffer overflow

Source: https://junglewise.ai/threats/cve-2026-63626-mongoose-is-an-embedded-web-server-and-network-library-prior-to-7  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-63626 · Severity: high · CVSS 8.8 · Published 2026-10-14

Mongoose is an embedded web server and network library used in IoT and embedded devices. A flaw in PPP protocol handling allows an unauthenticated attacker on an adjacent network to send a specially crafted packet that causes the server to read and write beyond allocated memory buffers. This can lead to information disclosure or system crashes.

Technologies: [Cesanta Mongoose](https://junglewise.ai/threats/technologies/cesanta-mongoose). Vendors: [Cesanta](https://junglewise.ai/threats/vendors/cesanta).

## Quick answers

**Is CVE-2026-63626 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63626 being exploited in the wild.

**How severe is CVE-2026-63626?** High severity, with a CVSS score of 8.8, published 14 October 2026.

**Which products and versions are affected?** Cesanta Mongoose before 7.23.

**Is there a fix for CVE-2026-63626?** Yes: fixed in 7.23. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63626 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2026-63626?** Check whether you run Cesanta Mongoose at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7.23

## Technical details

The ppp_handle_ipv6cp() function in src/l2_ppp.c fails to validate that the 16-bit IPv6CP length field matches the actual payload size before using it to read and write buffer data. An unauthenticated adjacent peer on a PPP or PPPoE link can complete the LCP handshake and send a Configure-Request with an oversized length value, causing out-of-bounds reads from recv_queue.buf and writes to tx.buf. The same vulnerability allows heap information disclosure via find_opt() and denial of service through event loop hangs.

## Affected products

- Cesanta Mongoose before 7.23

## Timeline

- 2026-10-14: advisory

## References

- [https://github.com/cesanta/mongoose/commit/751f14742dea934bec08a507ab1fecc3673d4903](https://github.com/cesanta/mongoose/commit/751f14742dea934bec08a507ab1fecc3673d4903)
- [https://github.com/cesanta/mongoose/releases/tag/7.23](https://github.com/cesanta/mongoose/releases/tag/7.23)

## Related threats

- [Mongoose heap out-of-bounds read in path validation](https://junglewise.ai/threats/cve-2026-115473-mongoose-is-an-embedded-web-server-and-network-library-prior-to)
- [Mongoose TCP option parser bounds check vulnerability](https://junglewise.ai/threats/cve-2026-73261-mongoose-is-an-embedded-web-server-and-network-library-prior-to-7)
- [Mongoose TLS certificate parser bounds check in DER parsing](https://junglewise.ai/threats/cve-2026-73260-mongoose-is-an-embedded-web-server-and-network-library-prior-to-7)
- [Mongoose TLS short-record out-of-bounds read](https://junglewise.ai/threats/cve-2026-73252-mongoose-is-an-embedded-web-server-and-network-library-prior-to-7)
- [Cesanta Mongoose stack-based buffer overflow in MQTT broker](https://junglewise.ai/threats/cve-2026-101003-a-weakness-has-been-identified-in-cesanta-mongoose-up-to-7-21)