CVE-2026-73257
Received Received - Intake

Mongoose HTTP CL.TE Request Smuggling

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_http_parse() and http_cb() paths in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy can use a different request boundary. This CL.TE desynchronization can inject requests that access or modify resources in another user context. This issue is fixed in version 7.22.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-73257
EUVD
EUVD-2026-63492

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
mongoose mongoose to 7.22 (inc)
cesanta mongoose to 7.22 (exc)
cesanta mongoose 7.22

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-444 The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an HTTP request smuggling vulnerability in Mongoose versions prior to 7.22. It occurs when a server accepts HTTP requests containing both Content-Length and Transfer-Encoding: chunked headers. Mongoose prioritizes chunked encoding but a Content-Length-preferring proxy may interpret the request differently, causing a desynchronization. This allows attackers to smuggle malicious requests past the proxy and into the backend server.

Detection Guidance

To detect this vulnerability, monitor HTTP requests for the presence of both Content-Length and Transfer-Encoding headers in the same request. Use tools like Wireshark or tcpdump to capture and analyze traffic for malformed requests. Check server logs for unusual patterns or requests accessing unauthorized resources.

Impact Analysis

An attacker could exploit this to access or modify resources in another user's context. For example, they might send a smuggled request like GET /admin to gain unauthorized access to sensitive data or administrative functions. This could lead to data breaches, account takeovers, or other malicious actions without authentication.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Organizations using affected Mongoose versions may face compliance violations, regulatory fines, and reputational damage due to potential data breaches or unauthorized data exposure.

Mitigation Strategies

Upgrade Mongoose to version 7.22 or later immediately. Configure reverse proxies to reject requests containing both headers. Implement WAF rules to block such requests. Monitor network traffic for signs of exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73257. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart