cve.bz

CVE-2026-73257

9.1 criticalEPSS 0.7%

Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_http_parse() and http_cb() paths in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy can use a different request boundary. This CL.TE desynchronization can inject requests that access or modify resources in another user context. This issue is fixed in version 7.22.

CVSS 3.1
9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS
0.7% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-25)
CWE
CWE-444
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON