CVE-2026-73256

Katalog CVE

CVSS 9.1 · Critical EPSS 0,44%

Kerentanan Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') pada cesanta mongoose. Skor CVSS 3.1 9.1 (Critical) menurut github.com.

Deskripsi (NVD)

Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http_cb() function in src/http.c tests hm.proto.len with an impossible greater-than-eight condition even though mg_http_parse() requires an eight-byte protocol string, so is_http_1_0 is never set. Mongoose consequently processes chunked encoding that an HTTP/1.0 proxy can ignore, enabling request smuggling and unauthorized access or state changes. This issue is fixed in version 7.22.

Rincian

Terbit di NVD

20 Agustus 2026

Terakhir diubah

29 September 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/cesanta/mongoose/security/advisories/GHSA-mgp5-rjrv-h5j3 exploit · advisory vendor
• https://github.com/cesanta/mongoose/commit/a9df523f76f43a38bd53b4232b9cfd4c16869e71 patch
• https://github.com/cesanta/mongoose/pull/3611 issue tracking · patch
• https://github.com/cesanta/mongoose/releases/tag/7.22 release notes