High severity · published Mar 6, 2026
CVE-2018-25193
Mongoose Web Server 6.9 Denial of Service via Socket Connection
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
Mongoose Web Server 6.9 contains a denial of service vulnerability that allows remote attackers to crash the service by establishing multiple socket connections. Attackers can repeatedly create connections to the default port and send malformed data to exhaust server resources and cause service unavailability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MW
Mongoose Web Server · Cesanta
6.9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-25193
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-25193
www.exploit-db.com
https://www.exploit-db.com/exploits/45819
www.vulncheck.com
https://www.vulncheck.com/advisories/mongoose-web-server-denial-of-service-via-socket-connection
More from Mongoose Web Server
9.8
CVE-2024-42383
Use of Out-of-range Pointer Offset in Mongoose Web Server library
7.5
CVE-2024-42392
Improper Neutralization of Delimiters in Mongoose Web Server library
7.5
CVE-2024-42386
Use of Out-of-range Pointer Offset in Mongoose Web Server library
7.5
CVE-2024-42384
Integer Overflow or Wraparound in Mongoose Web Server library
7.0
CVE-2024-42385
Improper Neutralization of Delimiters in Mongoose Web Server library