CVE-2026-73257 Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling
Remote attackers can exploit HTTP request smuggling in Mongoose to access or modify resources in other user contexts via CL.TE desynchronization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73257?
CVE-2026-73257 is a critical vulnerability in Cesanta Mongoose, published on 20 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_http_parse() and http_cb() paths in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy can use a different request boundary. This CL.TE desynchronization can inject requests that access or modify resources in another user context. This issue is fixed in version 7.22.
Weakness: CWE-444
Which versions are affected by CVE-2026-73257?
It affects 1 product.
Products include Cesanta Mongoose.
How do I fix CVE-2026-73257?
Upgrade to a fixed version.
Is CVE-2026-73257 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73257 exists.
Other vulnerabilities in Cesanta Mongoose
Sources
Also known as DEBIAN-CVE-2026-73257, GHSA-5wfq-r6mr-wqp6, JLSEC-2026-1381, UBUNTU-CVE-2026-73257.