# CVE-2026-6985: A weakness has been identified in Cesanta Mongoose up to 7.20. This vulnerability affects the function handle_opt of…

Source: https://junglewise.ai/threats/cve-2026-6985-a-weakness-has-been-identified-in-cesanta-mongoose-up-to-7-20-this  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-25  
License: CC BY 4.0 with a link back

CVE-2026-6985 · Severity: medium · CVSS 5.3 · Published 2026-04-25

A weakness has been identified in Cesanta Mongoose up to 7.20. This vulnerability affects the function handle_opt of the file /src/net_builtin.c of the component TCP Option Handler. This manipulation of the argument optlen causes infinite loop. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 7.21 is able to resolve this issue. Upgrading the affected component is advised. VulDB has contacted the vendor early and they confirmed quickly, that this issue got fixed already.

Technologies: [Cesanta Mongoose](https://junglewise.ai/threats/technologies/cesanta-mongoose). Vendors: [Cesanta](https://junglewise.ai/threats/vendors/cesanta).

## Quick answers

**Is CVE-2026-6985 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-6985 being exploited in the wild.

**How severe is CVE-2026-6985?** Medium severity, with a CVSS score of 5.3, published 25 April 2026.

**Which products and versions are affected?** Cesanta Mongoose. The advisory does not name versions.

**Is there a fix for CVE-2026-6985?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-6985?** Check whether you run Cesanta Mongoose. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Cesanta Mongoose

## Related threats

- [Mongoose heap out-of-bounds read in path validation](https://junglewise.ai/threats/cve-2026-115473-mongoose-is-an-embedded-web-server-and-network-library-prior-to)
- [Mongoose TCP option parser bounds check vulnerability](https://junglewise.ai/threats/cve-2026-73261-mongoose-is-an-embedded-web-server-and-network-library-prior-to-7)
- [Mongoose TLS certificate parser bounds check in DER parsing](https://junglewise.ai/threats/cve-2026-73260-mongoose-is-an-embedded-web-server-and-network-library-prior-to-7)
- [Mongoose TLS short-record out-of-bounds read](https://junglewise.ai/threats/cve-2026-73252-mongoose-is-an-embedded-web-server-and-network-library-prior-to-7)
- [Mongoose IPv6CP length field bounds check buffer overflow](https://junglewise.ai/threats/cve-2026-63626-mongoose-is-an-embedded-web-server-and-network-library-prior-to-7)