by Kastro
Paper/Archive/CVE-2026-73257

CVE-2026-73257

cesanta mongoose — Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling

EPSS 0.7%public exploitCVSS 9.1
critical.is priorityof 100
48
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 52.1.521 × 2010.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_http_parse() and http_cb() paths in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy can use a different request boundary. This CL.TE desynchronization can inject requests that access or modify resources in another user context. This issue is fixed in version 7.22.

Affected

ProductAffectedFixed inSource
mongoose< 7.22–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/cesanta/mongoose/security/advisories/GHSA-5wfq-r6mr-wqp6refgithub.com/cesanta/mongoose/pull/3611refgithub.com/cesanta/mongoose/commit/a9df523f76f43a38bd53b4232b9cfd4c16869e71refgithub.com/cesanta/mongoose/releases/tag/7.22