CVE-2026-6985

Name	CVE-2026-6985
Description	A weakness has been identified in Cesanta Mongoose up to 7.20. This vulnerability affects the function handle_opt of the file /src/net_builtin.c of the component TCP Option Handler. This manipulation of the argument optlen causes infinite loop. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 7.21 is able to resolve this issue. Upgrading the affected component is advised. VulDB has contacted the vendor early and they confirmed quickly, that this issue got fixed already.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
mongoose (PTS)	forky, sid	7.21+ds-2	fixed
swupdate (PTS)	bullseye	2020.11-2+deb11u1	vulnerable
	bookworm	2022.12+dfsg-4+deb12u2	vulnerable
	trixie	2024.12.1+dfsg-3+deb13u2	vulnerable
	forky, sid	2026.05+dfsg-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
mongoose	source	(unstable)	(not affected)
swupdate	source	(unstable)	2025.12+dfsg-10

Notes

- mongoose <not-affected> (Fixed before or with initial upload)
[trixie] - swupdate <no-dsa> (Minor issue)
[bookworm] - swupdate <no-dsa> (Minor issue)
[bullseye] - swupdate <postponed> (Minor issue)