{"action":"Upgrade mongoose to 7.22+ds-1 or later.","affected":[{"fixed":"7.22+ds-1","introduced":"0"}],"component":"mongoose","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["7.22+ds-1"],"id":"tcs_01M5NQB3M45VT4G9T3S1DFDWQQ","modified_at":"2026-10-26T11:47:35.641320021Z","published_at":"2026-07-09T16:16:34.640Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-11404","https://security-tracker.debian.org/tracker/CVE-2026-11404"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-11404","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-11404"}],"summary":"Cesanta Mongoose before 7.22 contains an out-of-bounds read in the built-in TLS server function mg_tls_server_recv_hello(), which uses an attacker-controlled session_id_len byte from a TLS ClientHello"}