cesanta/mongoose 7.23

Mongoose 7.23

on GitHub

Overview

This release adds fixes and improvements, and more examples.

Security fixes

• [CVE-2026-73261] Built-in TCP/IP malformed TCP option handling
• [CVE-2026-73260] Built-in TLS X.509 DER parsing bounds check
• [CVE-2026-63626] Built-in TCP/IP PPP IPV6CP option parsing bounds check
• [CVE-2026-73252] Built-in TLS short-record handling
• [CVE-2026-73251] Built-in TLS certificate-chain verification with CA bundles

Important Changes

• Added HTTP Bearer Authentication with JSON Web Token (JWT) support and tutorial
• Added mg_uecc_parse_private_key() to help in extracting private key data, enhancing support for JWT
• Added mg_base64url_encode() and mg_base64url_decode(), complementing JWT support
• Added DNS-SD query and response support, with an mDNS/DNS-SD client tutorial
• Added OTA rollback support for ESP32 and NXP i.MX RT boards
• Added MG_ARCH_MCUXPRESSO support, to ease integration with the NXP toolchain
• Added mg_crc16(), a CRC-16/ISO-HDLC generation helper function
• Added mg_dscp() for setting Differentiated Services Code Point (DSCP) on outgoing traffic
• TLS hostname checking now works without a configured CA certificate
• Improved PPPoE and VLAN interoperability
• Improved Mongoose BSD socket layer stability, data integrity, and throughput under queue pressure
• Improved FreeRTOS+TCP handling
• Improved WolfSSL compatibility with the built-in TCP/IP stack
• Improved C89 compiler compatibility and added more test targets and coverage
• Added more test targets for big-endian platforms

Minor changes

• Improved mg_aton() IPv6 address processing
• Added %zu formatting support for printf-like functions
• Improved JSON malformed hex input handling
• Improved Ethernet FCS validation on big-endian and unaligned-access platforms
• Built-in TLS now initializes its time source when needed
• Improved built-in TCP/IP testing
• Improved built-in TLS testing
• Improved test coverage