CVE-2026-73257
CVE-2026-73257 · Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_http_parse() and http_cb() paths in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy can use a different request boundary. This CL.TE desynchronization can inject requests that access or modify resources in another user context. This issue is fixed in version 7.22.
CVSS 9.1 · Crítica · EPSS 0,7% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: system
Productos y versiones afectados
mongoose
- Versiones
- < 7.22: Afectada
Sin corrección publicada
mongoose Debian:14
- Versiones
- 7.21+ds-1
- 7.21+ds-1~bpo13+1
- 7.21+ds-2
- 7.22+ds-1~bpo13+1
- Intervalos de versiones afectados
- ECOSYSTEM: < 7.22+ds-1
Actualiza a 7.22+ds-1
mongoose Ubuntu:26.10
- Versiones
- 7.21+ds-1
- 7.21+ds-2
- 7.22+ds-1
- 7.23+ds-1
- Intervalos de versiones afectados
- ECOSYSTEM: (−∞, +∞)
Sin corrección publicada
Fuentes originales
- https://github.com/cesanta/mongoose/security/advisories/GHSA-5wfq-r6mr-wqp6
- https://github.com/cesanta/mongoose/pull/3611
- https://github.com/cesanta/mongoose/commit/a9df523f76f43a38bd53b4232b9cfd4c16869e71
- https://github.com/cesanta/mongoose/releases/tag/7.22
- https://nvd.nist.gov/vuln/detail/CVE-2026-73257