CVE-2026-73258

Katalog CVE

CVSS 6.5 · Medium EPSS 0,46%

Kerentanan Incorrect Comparison pada cesanta mongoose. Skor CVSS 3.1 6.5 (Medium) menurut github.com.

Deskripsi (NVD)

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mg_http_next_multipart() in src/http.c. The loops comparing s[b] and s[b + 1], and s[h2] and s[h2 + 1], use an incorrect AND condition and stop when either character resembles part of a CRLF terminator. This truncates headers, filenames, or boundaries and can cause an application to accept dangerous content after seeing a misleading Content-Type value. This issue is fixed in version 7.22.

Rincian

Terbit di NVD

20 Agustus 2026

Terakhir diubah

29 September 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-697: Incorrect Comparison

EPSS (30 hari)

0,46% peluang dieksploitasi; lebih tinggi dari 38,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/cesanta/mongoose/security/advisories/GHSA-cc55-8v3r-59p8 exploit · advisory vendor
• https://github.com/cesanta/mongoose/commit/a9df523f76f43a38bd53b4232b9cfd4c16869e71 patch
• https://github.com/cesanta/mongoose/pull/3611 issue tracking · patch
• https://github.com/cesanta/mongoose/releases/tag/7.22 release notes