CVE-2026-73261
CVE-2026-73261 · Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connection
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP in src/net_builtin.c does not reject a TCP option whose declared opts[1] length exceeds the remaining option bytes. In handle_opt(), a NOP followed by a truncated MSS option causes opts[3] to be read outside the declared options area and used as the low byte of dmss. An unauthenticated remote peer can corrupt the per-connection MSS value so later mg_send() calls transmit truncated or zero-length application payloads while the TCP connection otherwise appears healthy. This issue is fixed in version 7.23.
CVSS 7.5 · Alta · EPSS 0,3% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: system
Productos y versiones afectados
mongoose
- Versiones
- < 7.23: Afectada
Sin corrección publicada
mongoose Debian:14
- Versiones
- 7.21+ds-1
- 7.21+ds-1~bpo13+1
- 7.21+ds-2
- 7.22+ds-1
- 7.22+ds-1~bpo13+1
- 7.23+ds-1~bpo13+1
- Intervalos de versiones afectados
- ECOSYSTEM: < 7.23+ds-1
Actualiza a 7.23+ds-1
mongoose Ubuntu:26.10
- Versiones
- 7.21+ds-1
- 7.21+ds-2
- 7.22+ds-1
- 7.23+ds-1
- Intervalos de versiones afectados
- ECOSYSTEM: (−∞, +∞)
Sin corrección publicada