Mongoose: Preauth RCE and MTLS Bypass on Devices Posted by evilsocket on Thursday April 02, 2026 @09:37AM from the evilsocket.net dept. https://www.evilsocket.net/2026/04/02/Mongoose-Preauth-Remote-Code-Execution-and-mTLS-Bypass/ ( 1 comment | 2 points | on HN )
CVE-2026-5244 - mg_tls_recv_cert pubkey heap-based overflow (exploitable), CVE-2026-5245 - mDNS Record stack-based overflow (exploitable), CVE-2026-5246 - authorization bypass via P-384 Public Key (trivially exploitable)
Fun ride.