CVE-2026-73258Medium· 6.5▾ TwilightPoC availableMongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mg_http_next_multipart() in src/http.c. The loops comparing s[b] and s…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 35.8 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.5%
Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mg_http_next_multipart() in src/http.c. The loops comparing s[b] and s[b + 1], and s[h2] and s[h2 + 1], use an incorrect AND condition and stop when either character resembles part of a CRLF terminator. This truncates headers, filenames, or boundaries and can cause an application to accept dangerous content after seeing a misleading Content-Type value. This issue is fixed in version 7.22.
mongoose < 7.22Upgrade past the affected range:
mongoose 7.22Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73253Critical· 9.1Mongoose is an embedded web server and network library
CVE-2026-73254Medium· 5.4Mongoose is an embedded web server and network library
CVE-2026-73255Medium· 6.5Mongoose is an embedded web server and network library
CVE-2026-73256Critical· 9.1Mongoose is an embedded web server and network library
CVE-2026-73257Critical· 9.1Mongoose is an embedded web server and network library
CVE-2026-73259Medium· 5.4Mongoose is an embedded web server and network library