CVE-2026-63626

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 7.23

Description The ppp handle ipv6cp() function in src/l2 ppp.c trusts the 16-bit IPv6CP length field without verifying it against the received payload size. On a PPP or PPPoE link where MG ENABLE TCPIP and MG ENABLE IPV6 are enabled, an unauthenticated adjacent peer can complete the LCP exchange and send a short Configure-Request with an oversized length. This causes ppp tx frame() to read beyond recv queue.buf and write beyond tx.buf. This length misuse can also lead to the exposure of adjacent heap bytes in a reply or cause the event loop to hang through find opt().

Recommendations Update to version 7.23.