CVE-2026-73256Critical· 9.1▾ MidnightMongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The h…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
0.4% → 0.7%
Last analysed / modified upstream
Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http_cb() function in src/http.c tests hm.proto.len with an impossible greater-than-eight condition even though mg_http_parse() requires an eight-byte protocol string, so is_http_1_0 is never set. Mongoose consequently processes chunked encoding that an HTTP/1.0 proxy can ignore, enabling request smuggling and unauthorized access or state changes. This issue is fixed in version 7.22.
mongoose < 7.22Upgrade past the affected range:
mongoose 7.22Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73257Critical· 9.1Mongoose is an embedded web server and network library
CVE-2026-73253Critical· 9.1Mongoose is an embedded web server and network library
CVE-2026-101003Medium· 5.3A weakness has been identified in Cesanta Mongoose up to 7.21
CVE-2026-73258Medium· 6.5Mongoose is an embedded web server and network library
CVE-2026-73254Medium· 5.4Mongoose is an embedded web server and network library
CVE-2026-73255Medium· 6.5Mongoose is an embedded web server and network library