{"metadata": {"vulnerability": "CVE-2026-63626", "count": 12, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-07-17T14:11:15.481Z", "date_only": false, "value": "2026-07-17T14:11:15.481Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-63626", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-14T00:00:00Z", "date_only": false, "value": "2026-08-14T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-63626", "record": "UBUNTU-CVE-2026-63626", "field": "published"}, {"timestamp": "2026-08-14T00:00:00Z", "date_only": false, "value": "2026-08-14T00:00:00Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-63626", "record": "UBUNTU-CVE-2026-63626", "field": "modified"}, {"timestamp": "2026-10-14T18:26:16.830Z", "date_only": false, "value": "2026-10-14T18:26:16.830Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-63626", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T18:26:16.830Z", "date_only": false, "value": "2026-10-14T18:26:16.830Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-63626", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T19:17:18.570Z", "date_only": false, "value": "2026-10-14T19:17:18.570", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-63626", "record": "FKIE_CVE-2026-63626", "field": "published"}, {"timestamp": "2026-10-14T23:41:50.768Z", "date_only": false, "value": "2026-10-14T23:41:50.768158Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117441908593546870", "record": "CVE-2026-63626", "field": "creation_timestamp", "uuid": "9cd14898-8f99-4fdc-97ef-e413339b89cc", "content": "CVE-2026-63626 Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check \u2014 OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6) Mongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MG_ENABLE_TCPIP and MG_ENABLE_IPV6, an unauthenticated adjacent peer can complete the required LCP exchange and send a short Configure-Request with an oversized length, causing ppp_tx_frame() to read beyond recv_queue.buf and write beyond tx.buf. The same length misuse can also expose adjacent heap bytes in a reply or hang the event loop through find_opt(). This issue is fixed in version 7.23.\nhttps://www.cve.org/CVERecord?id=CVE-2026-63626https://github.com/cesanta/mongoose/security/advisories/GHSA-pc66-j6r6-49x9https://github.com/cesanta/mongoose/commit/751f14742dea934bec08a507ab1fecc3673d4903https://github.com/cesanta/mongoose/releases/tag/7.23#cesanta #mongoose#CVE_2026_63626#bot", "url": "https://infosec.exchange/users/cve/statuses/117441908593546870"}, {"timestamp": "2026-10-15T13:53:23.078Z", "date_only": false, "value": "2026-10-15T13:53:23.078452Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-63626", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-15T13:53:23.078Z", "date_only": false, "value": "2026-10-15T13:53:23.078452Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-63626", "record": "FKIE_CVE-2026-63626", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-15T15:06:33.386Z", "date_only": false, "value": "2026-10-15T15:06:33.386Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-63626", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-15T15:06:33.386Z", "date_only": false, "value": "2026-10-15T15:06:33.386Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-63626", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T20:04:29.760Z", "date_only": false, "value": "2026-10-16T20:04:29.760", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-63626", "record": "FKIE_CVE-2026-63626", "field": "lastModified"}]}