CVE-2026-2966 | Cesanta Mongoose up to 7.20 DNS Transaction ID /src/dns.c mg_sendnsreq random random values

A vulnerability was found in Cesanta Mongoose up to 7.20. It has been declared as problematic. The impacted element is the function mg_sendnsreq of the file /src/dns.c of the component DNS Transaction ID Handler. Executing a manipulation of the argument random can lead to insufficiently random values.

This vulnerability is tracked as CVE-2026-2966. The attack can be launched remotely. Moreover, an exploit is present.

The vendor was contacted early about this disclosure but did not respond in any way.