CVE-2026-73260

Deferred Deferred - Pending Action

Buffer Overflow in Mongoose TLS Certificate Parser

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MG_TLS_BUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mg_der_to_tlv() and mg_der_next(), a peer-controlled length can advance the parser beyond the certificate and underflow the remaining uint32_t length, causing mg_tls_parse_cert_der() to continue walking an invalid pointer. An unauthenticated malicious TLS server, or a client presenting a certificate to a server configured for client certificates, can trigger an out-of-bounds read and denial of service during the handshake. This issue is fixed in version 7.23.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-73260

EUVD

EUVD-2026-101597

Affected Vendors & Products

Vendor	Product	Version / Range
cesanta	mongoose	< 7.23

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is an out-of-bounds read vulnerability in the Mongoose library's built-in TLS X.509 DER parser. A malicious TLS peer can craft a certificate with a long-form length counter that underflows, causing the parser to read memory outside the intended buffer. This triggers during the TLS handshake when parsing a peer certificate and can lead to a denial of service by crashing the process.

Detection Guidance

Detecting this vulnerability requires checking the version of Mongoose in use. If your system uses Mongoose for TLS operations, verify the installed version is 7.23 or later. Commands like 'grep' or 'find' can locate Mongoose binaries or libraries. For example, 'find / -name "mongoose*" 2>/dev/null' may help identify the library path. Compare the version with '7.23' to confirm if the system is vulnerable.

Impact Analysis

The vulnerability can cause a denial of service by crashing the process, especially on systems with an MMU. On bare-metal or no-MMU targets, the behavior is undefined. It requires no authentication or credentials to trigger and occurs during the TLS handshake when parsing a peer certificate.

Compliance Impact

This vulnerability primarily impacts system availability due to denial of service during TLS handshakes, which could disrupt services handling sensitive data. While it does not directly cause data breaches or unauthorized access, prolonged downtime may violate compliance requirements for data availability in standards like GDPR (Article 32) or HIPAA (Availability requirements). The lack of remote code execution or information leaks limits direct regulatory impact but operational disruptions could still pose compliance risks.

Mitigation Strategies

Immediately upgrade Mongoose to version 7.23 or later to patch the vulnerability. If upgrading is not possible, disable TLS certificate parsing in Mongoose or avoid using Mongoose for TLS operations until patched. Monitor network traffic for unusual TLS handshake failures that may indicate exploitation attempts.

Hi! I’m here to help you understand CVE-2026-73260. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70