Cesanta Mongoose up to 7.21 Http Parsing src/http.c mg_http_parse/http_cb encoding error

Summaryinfo

A vulnerability labeled as critical has been found in Cesanta Mongoose up to 7.21. This affects the function mg_http_parse/http_cb of the file src/http.c of the component Http Parsing. Executing a manipulation can lead to encoding error. This vulnerability is tracked as CVE-2026-73257. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Cesanta Mongoose up to 7.21. It has been declared as critical. This vulnerability affects the function mg_http_parse/http_cb of the file src/http.c of the component Http Parsing. The manipulation with an unknown input leads to a encoding error vulnerability. The CWE definition for the vulnerability is CWE-172. The product does not properly encode or decode the data, resulting in unexpected values. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_http_parse() and http_cb() paths in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy can use a different request boundary. This CL.TE desynchronization can inject requests that access or modify resources in another user context. This issue is fixed in version 7.22.

The advisory is available at github.com. This vulnerability was named CVE-2026-73257 since 08/11/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 7.22 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CNNVD (CNNVD-2026-99901444). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Cesanta

Name

• Mongoose

Version

• 7.0
• 7.1
• 7.2
• 7.3
• 7.4
• 7.5
• 7.6
• 7.7
• 7.8
• 7.9
• 7.10
• 7.11
• 7.12
• 7.13
• 7.14
• 7.15
• 7.16
• 7.17
• 7.18
• 7.19
• 7.20
• 7.21

License

• open-source

Website

• Product: https://github.com/cesanta/mongoose/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion