CVE-2026-73258 Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart
A logic error in Mongoose's multipart parser allows attackers to truncate headers or boundaries, potentially bypassing content-type checks and exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73258?
CVE-2026-73258 is a medium-severity vulnerability in Cesanta Mongoose, published on 20 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mg_http_next_multipart() in src/http.c. The loops comparing s[b] and s[b + 1], and s[h2] and s[h2 + 1], use an incorrect AND condition and stop when either character resembles part of a CRLF terminator. This truncates headers, filenames, or boundaries and can cause an application to accept dangerous content after seeing a misleading Content-Type value. This issue is fixed in version 7.22.
Weakness: CWE-697
Which versions are affected by CVE-2026-73258?
It affects 1 product.
Products include Cesanta Mongoose.
How do I fix CVE-2026-73258?
Upgrade to a fixed version.
Is CVE-2026-73258 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73258 exists.
Other vulnerabilities in Cesanta Mongoose
Sources
Also known as DEBIAN-CVE-2026-73258, GHSA-cc55-8v3r-59p8, JLSEC-2026-1382, UBUNTU-CVE-2026-73258.