Bug 2441855 (CVE-2026-2966)

Summary: CVE-2026-2966 Mongoose: Mongoose: Information disclosure due to insufficiently random values in DNS transaction ID handling
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Cesanta Mongoose. A remote attacker could exploit a weakness in the mg_sendnsreq function within the DNS Transaction ID Handler component. By manipulating the random argument, an attacker can cause the generation of insufficiently random values. This vulnerability can lead to information disclosure.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2441887, 2441888, 2441889, 2441890, 2441891, 2441892, 2441893    
Bug Blocks:    

Description OSIDB Bzimport 2026-02-23 03:01:34 UTC 
A weakness has been identified in Cesanta Mongoose up to 7.20. The impacted element is the function mg_sendnsreq of the file /src/dns.c of the component DNS Transaction ID Handler. Executing a manipulation of the argument random can lead to insufficiently random values. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is regarded as difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.