CVE-2024-42392: 
NixOS vulnerability analysis and mitigation

An Improper Neutralization of Delimiters vulnerability has been identified in Cesanta Mongoose Web Server v7.14 (CVE-2024-42392). The vulnerability was discovered and disclosed in November 2024, affecting the web server's handling of input strings containing unexpected characters (NVD Database, Nozomi Advisory).

The vulnerability is classified as an Improper Neutralization of Delimiters issue (CWE-140). According to the National Vulnerability Database, it has received a CVSS v3.1 base score of 7.5 (HIGH) from NIST with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, while Nozomi Networks assigned it a score of 4.0 (MEDIUM) with vector string CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H (NVD Database).

The vulnerability can trigger an infinite loop bug when the input string contains unexpected characters, potentially affecting the availability of the web server (Nozomi Advisory).

It is strongly recommended not to expose the vulnerable component inside an untrusted network. The vulnerability affects Mongoose Web Server version 7.14, and users should monitor for patches or updates from the vendor (Nozomi Advisory).