CVE-2026-73258: medium-severity vulnerability in cesanta mongoose
Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.5%
Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mg_http_next_multipart() in src/http.c. The loops comparing s[b] and s[b + 1], and s[h2] and s[h2 + 1], use an incorrect AND condition and stop when either character resembles part of a CRLF terminator. This truncates headers, filenames, or boundaries and can cause an application to accept dangerous content after seeing a misleading Content-Type value. This issue is fixed in version 7.22.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
cesanta · mongooseRelated CVEs — cesanta mongoose
In the same product, most dangerous first.
CVE-2026-73257CRITICALMongoose: Content-Length + Transfer-Encoding coexistence enables request smugglingEPSS 0.7%CVE-2026-73255MEDIUMMongoose: Path traversal in SSI #include directives enables arbitrary file readEPSS 0.7%CVE-2026-73256CRITICALMongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TEEPSS 0.4%CVE-2026-73261HIGHMongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connectionEPSS 0.4%CVE-2026-73259MEDIUMMongoose: Reflected XSS via decoded URI in directory listing renderEPSS 0.4%CVE-2026-73252HIGHMongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAXEPSS 0.4%