CVE-2026-115473

Received Received - Intake

Heap Out-of-Bounds Read in Mongoose Web Server

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description

Mongoose is an embedded web server and network library. Prior to 7.22, mg_path_is_sane in src/util.c read path.buf[1] without first requiring path.len to be at least two and read s[2] when only two bytes remained. Unauthenticated remote requests reaching mg_http_upload or mg_http_serve_dir with the affected short path shapes could therefore trigger one-byte heap out-of-bounds reads. On bare-metal or RTOS targets without memory protection, the adjacent byte could be exposed or influence whether a path was accepted, and instrumented builds could crash. This issue is fixed in version 7.22.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-115473

Affected Vendors & Products

Vendor	Product	Version / Range
cesanta	mongoose	< 7.22

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.
CWE-158	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability is in Mongoose, an embedded web server and network library. It involves a flaw in the mg_path_is_sane function where it reads memory outside the intended path buffer due to insufficient length checks. Specifically, it accesses path.buf[1] without ensuring path.len is at least two and reads s[2] when only two bytes remain. This can lead to one-byte heap out-of-bounds reads.

Detection Guidance

This vulnerability can be detected by checking the version of Mongoose running on your system. If the version is below 7.22, the system is vulnerable. Commands like 'grep' or 'find' can be used to locate the Mongoose library version in your system files or binaries.

Impact Analysis

Unauthenticated remote attackers could exploit this to read adjacent memory bytes, potentially exposing sensitive data or causing crashes in instrumented builds. On systems without memory protection like bare-metal or RTOS, attackers might influence path validation or access unauthorized data.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it involves a heap out-of-bounds read in a web server library. However, if exploited, it could lead to unauthorized data exposure or crashes, which may indirectly impact compliance by compromising data integrity or availability.

Mitigation Strategies

Immediately upgrade Mongoose to version 7.22 or later to address the vulnerability. Ensure all instances of the library are updated to prevent potential exploitation.

Hi! I’m here to help you understand CVE-2026-115473. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...