CVE-2026-73261

Deferred Deferred - Pending Action

TCP/IP Stack MSS Option Handling Flaw in Mongoose

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP in src/net_builtin.c does not reject a TCP option whose declared opts[1] length exceeds the remaining option bytes. In handle_opt(), a NOP followed by a truncated MSS option causes opts[3] to be read outside the declared options area and used as the low byte of dmss. An unauthenticated remote peer can corrupt the per-connection MSS value so later mg_send() calls transmit truncated or zero-length application payloads while the TCP connection otherwise appears healthy. This issue is fixed in version 7.23.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-73261

EUVD

EUVD-2026-101598

Affected Vendors & Products

Vendor	Product	Version / Range
cesanta	mongoose	< 7.23

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability in the Mongoose library (versions up to 7.22) involves a missing length check in the TCP option parser. When processing TCP options, a crafted packet with a NOP followed by a truncated MSS option can cause the parser to read one byte outside the valid options area. This corrupts the TCP Maximum Segment Size (MSS) value, potentially setting it to zero. As a result, all subsequent data transmissions on that connection send zero bytes of payload while the connection remains open.

Detection Guidance

Detecting this vulnerability requires monitoring for malformed TCP options in SYN packets. Use tcpdump to capture and analyze TCP options: tcpdump -i any 'tcp[tcpflags] & (tcp-syn) != 0' -vv. Look for packets with NOP followed by MSS options where the MSS length exceeds remaining bytes. Alternatively, use Wireshark with a filter for tcp.options.mss and inspect option lengths manually.

Impact Analysis

This vulnerability allows an unauthenticated remote attacker to disrupt data transmission over TCP connections managed by Mongoose. Affected connections will appear normal but fail to transmit any application data, effectively blocking communication. This can lead to service disruptions, failed data transfers, or degraded performance in applications using vulnerable Mongoose versions.

Compliance Impact

This vulnerability primarily impacts data integrity and availability by allowing an attacker to corrupt TCP MSS values, causing silent truncation of transmitted data. For GDPR, this could lead to unauthorized data exposure or loss if sensitive information is truncated during transmission. HIPAA compliance may be affected if protected health information is improperly transmitted due to truncated payloads.

Mitigation Strategies

Upgrade Mongoose to version 7.23 or later immediately. If upgrading is not possible, apply the patch from the official commit (cc7c6d2d18c28fcc6d085633dddd88402946140a) to add the missing length check in src/net_builtin.c. Temporarily block malformed TCP options at the network perimeter using firewalls or IDS rules.

Hi! I’m here to help you understand CVE-2026-73261. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70