CVE-2026-115473 in Mongoose
Summary
by MITRE • 11/05/2026
Mongoose is an embedded web server and network library. Prior to 7.22, mg_path_is_sane in src/util.c read path.buf[1] without first requiring path.len to be at least two and read s[2] when only two bytes remained. Unauthenticated remote requests reaching mg_http_upload or mg_http_serve_dir with the affected short path shapes could therefore trigger one-byte heap out-of-bounds reads. On bare-metal or RTOS targets without memory protection, the adjacent byte could be exposed or influence whether a path was accepted, and instrumented builds could crash. This issue is fixed in version 7.22.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
Mongoose serves as a widely adopted embedded web server and network library designed for resource-constrained environments such as bare-metal systems and real-time operating systems. The vulnerability identified within versions prior to 7.22 resides specifically in the path validation logic implemented by the mg_path_is_sane function located in src/util.c. This component is critical because it determines whether incoming URL paths are safe to process, acting as a gatekeeper for file system access and directory traversal prevention mechanisms used by higher-level handlers like mg_http_upload and mg_http_serve_dir. The core technical flaw involves an improper boundary check during string length validation. Specifically, the function attempts to read path.buf[1] without first verifying that the path buffer contains at least two bytes of data. Additionally, in scenarios where only two bytes remain available for reading, the code proceeds to access s[2], which exceeds the allocated bounds by one byte. This constitutes a classic heap out-of-bounds read vulnerability, classified under CWE-125: Out-of-bounds Read.
The operational impact of this flaw is significant due to its potential exploitation via unauthenticated remote requests. Attackers can craft HTTP requests with specifically shaped short paths that trigger the erroneous memory access within mg_http_upload or mg_http_serve_dir. On systems equipped with hardware memory protection, such as those running modern operating systems with Address Space Layout Randomization and stack canaries, this vulnerability might result in a denial of service through application crashes rather than direct code execution. However, for bare-metal targets and Real-Time Operating Systems that often lack sophisticated memory isolation features, the consequences are far more severe. The adjacent byte read from heap memory could expose sensitive internal state information to the attacker or influence control flow decisions by altering path acceptance logic. This behavior aligns with ATT&CK technique T1083: File and Directory Discovery, as it allows an unauthenticated actor to probe system internals through side-channel effects of out-of-bounds reads.
To mitigate this vulnerability, organizations utilizing Mongoose must upgrade immediately to version 7.22 or later, where the boundary checks in mg_path_is_sane have been corrected to ensure proper length validation before any array indexing occurs. For environments that cannot be patched instantly due to legacy constraints, implementing strict input sanitization at the network perimeter is recommended. This includes configuring firewalls or reverse proxies to reject HTTP requests with malformed paths or those containing suspiciously short URI segments that match the exploit pattern. Furthermore, developers should enforce compile-time security features such as stack protectors and heap hardening where supported by their toolchains to reduce the likelihood of successful exploitation even if similar logic errors exist elsewhere in the codebase. Regular auditing of third-party library versions is essential to maintain a secure posture against these types of low-level memory safety issues common in embedded C applications.