CVE-2026-73256 Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE

What is CVE-2026-73256?

CVE-2026-73256 is a critical vulnerability in Cesanta Mongoose, published on 20 Aug 2026.

Official description

Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http_cb() function in src/http.c tests hm.proto.len with an impossible greater-than-eight condition even though mg_http_parse() requires an eight-byte protocol string, so is_http_1_0 is never set. Mongoose consequently processes chunked encoding that an HTTP/1.0 proxy can ignore, enabling request smuggling and unauthorized access or state changes. This issue is fixed in version 7.22.

Weakness: CWE-444

Which versions are affected by CVE-2026-73256?

It affects 1 product.

Products include Cesanta Mongoose.

How do I fix CVE-2026-73256?

Upgrade to a fixed version.

Is CVE-2026-73256 being exploited?

There is no known exploitation of CVE-2026-73256 in the wild and no public exploit code.

Other vulnerabilities in Cesanta Mongoose

• CVE-2022-25299 Arbitrary File Write Critical 9.8
• CVE-2020-25756 Memory corruption in n/a Critical 9.8
• CVE-2019-19307 Integer overflow in n/a Critical 9.8
• CVE-2019-12951 Memory corruption in n/a Critical 9.8
• CVE-2018-20353 Use after free in n/a Critical 9.8

All Cesanta Mongoose vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-73256, GHSA-mgp5-rjrv-h5j3, JLSEC-2026-1380, UBUNTU-CVE-2026-73256.