CVE-2026-73257Critical· 9.1▾ MidnightMongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
0.4% → 0.7%
Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_http_parse() and http_cb() paths in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy can use a different request boundary. This CL.TE desynchronization can inject requests that access or modify resources in another user context. This issue is fixed in version 7.22.
mongoose < 7.22Upgrade past the affected range:
mongoose 7.22Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73256Critical· 9.1Mongoose is an embedded web server and network library
CVE-2026-73253Critical· 9.1Mongoose is an embedded web server and network library
CVE-2026-101003Medium· 5.3A weakness has been identified in Cesanta Mongoose up to 7.21
CVE-2026-73258Medium· 6.5Mongoose is an embedded web server and network library
CVE-2026-73254Medium· 5.4Mongoose is an embedded web server and network library
CVE-2026-73255Medium· 6.5Mongoose is an embedded web server and network library