Vulnerability Description
Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_http_parse() and http_cb() paths in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy can use a different request boundary. This CL.TE desynchronization can inject requests that access or modify resources in another user context. This issue is fixed in version 7.22.
CVSS Score
CRITICAL
Related Weaknesses (CWE)
References
- https://github.com/cesanta/mongoose/commit/a9df523f76f43a38bd53b4232b9cfd4c16869
- https://github.com/cesanta/mongoose/pull/3611
- https://github.com/cesanta/mongoose/releases/tag/7.22
- https://github.com/cesanta/mongoose/security/advisories/GHSA-5wfq-r6mr-wqp6
- https://github.com/cesanta/mongoose/security/advisories/GHSA-5wfq-r6mr-wqp6
FAQ
What is CVE-2026-73257?
CVE-2026-73257 is a vulnerability with a CVSS score of 9.1 (CRITICAL). Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked....
How severe is CVE-2026-73257?
CVE-2026-73257 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-73257?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.