---
id: CVE-2026-115473
title: 'Mongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c)'
summary: >-
  Mongoose is an embedded web server and network library. Prior to 7.22,
  mg_path_is_sane in src/util.c read path.buf[1] without first requiring
  path.len to be at least two and read s[2] when only two bytes remained.
  Unauthenticated remote …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-125
  - CWE-158
vendor: cesanta
product: mongoose
affected:
  - mongoose < 7.22
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-05T20:02:05.668751Z'
exploitAvailable: true
published: '2026-11-04'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:02:27.603Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115473'
references:
  - url: >-
      https://github.com/cesanta/mongoose/security/advisories/GHSA-cjmx-764f-286c
    label: >-
      https://github.com/cesanta/mongoose/security/advisories/GHSA-cjmx-764f-286c
  - url: >-
      https://github.com/cesanta/mongoose/commit/b55de8b151d1466a3e41d1f854f22eeb6faa23dc
    label: >-
      https://github.com/cesanta/mongoose/commit/b55de8b151d1466a3e41d1f854f22eeb6faa23dc
  - url: 'https://github.com/cesanta/mongoose/releases/tag/7.22'
    label: 'https://github.com/cesanta/mongoose/releases/tag/7.22'
tags:
  - cve.org
  - exploit-available
epss: 0.00264
epssPercentile: 0.18311
ingestedAt: '2026-11-05T22:38:31.692Z'
---

## Overview

Mongoose is an embedded web server and network library. Prior to 7.22, mg_path_is_sane in src/util.c read path.buf[1] without first requiring path.len to be at least two and read s[2] when only two bytes remained. Unauthenticated remote requests reaching mg_http_upload or mg_http_serve_dir with the affected short path shapes could therefore trigger one-byte heap out-of-bounds reads. On bare-metal or RTOS targets without memory protection, the adjacent byte could be exposed or influence whether a path was accepted, and instrumented builds could crash. This issue is fixed in version 7.22.

## Affected

- `mongoose < 7.22`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.