p PatchFirst

CVE-2026-73257

CVE-2026-73257 · Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_http_parse() and http_cb() paths in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy can use a different request boundary. This CL.TE desynchronization can inject requests that access or modify resources in another user context. This issue is fixed in version 7.22.

CVSS 9.1 · Critical · EPSS 0.7% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • mongoose

    Versions
    • < 7.22: Affected

    No fix published

  • mongoose Debian:14

    Versions
    • 7.21+ds-1
    • 7.21+ds-1~bpo13+1
    • 7.21+ds-2
    • 7.22+ds-1~bpo13+1
    Affected ranges
    • ECOSYSTEM: < 7.22+ds-1

    Update to 7.22+ds-1

  • mongoose Ubuntu:26.10

    Versions
    • 7.21+ds-1
    • 7.21+ds-2
    • 7.22+ds-1
    • 7.23+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →