CVE-2026-73258
Received Received - Intake

Mongoose HTTP Multipart Header Truncation Vulnerability

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mg_http_next_multipart() in src/http.c. The loops comparing s[b] and s[b + 1], and s[h2] and s[h2 + 1], use an incorrect AND condition and stop when either character resembles part of a CRLF terminator. This truncates headers, filenames, or boundaries and can cause an application to accept dangerous content after seeing a misleading Content-Type value. This issue is fixed in version 7.22.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-73258
EUVD
EUVD-2026-63495

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
mongoose mongoose 7.22
cesanta mongoose to 7.22 (exc)
cesanta mongoose to 7.21 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-697 The product compares two entities in a security-relevant context, but the comparison is incorrect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Mongoose library versions up to 7.21. It involves an incorrect boolean condition in the multipart form data parser function mg_http_next_multipart(). The flaw causes premature termination when scanning for line terminators, leading to truncated headers, corrupted filenames, and misidentified multipart boundaries.

Detection Guidance

To detect this vulnerability, check if your system is running Mongoose versions prior to 7.22. Inspect the source code for the flawed loops in mg_http_next_multipart() at lines 1801 and 1808 of mongoose.c. Look for the incorrect AND condition checking for '\r' and '\n' separately.

Impact Analysis

An attacker could exploit this to bypass security filters by embedding a lone carriage return in a multipart header. This could hide malicious content behind a seemingly safe content type, such as splitting a Content-Type header to disguise HTML or SVG as an image/png file.

Mitigation Strategies

Immediately update Mongoose to version 7.22 or later. If updating is not possible, review and modify multipart form data handling to ensure proper validation of CRLF sequences. Remove any reliance on mg_http_next_multipart() for security-critical applications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73258. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart