CVE-2026-73256 cesanta CVE debrief

Who should care

Users of Mongoose versions prior to 7.22, especially those deploying it as an embedded web server or network library in HTTP/1.0 reverse-proxy configurations, should be aware of the potential for request smuggling and unauthorized access or state changes. Organizations using Mongoose in such configurations should review their deployments and consider updating to version 7.22 or later. Security teams and vulnerability management teams should prioritize this issue due to its critical severity and potential impact on system security and data integrity. Additionally, operators and administrators of affected systems should monitor for suspicious activity related to chunked encoding and implement compensating controls as needed.

Technical summary

A remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment in Mongoose versions prior to 7.22 by sending a request with Transfer-Encoding: chunked and conflicting framing, enabling request smuggling and potentially leading to unauthorized access or state changes. The http_cb() function in src/http.c tests hm.proto.len with an impossible greater-than-eight condition even though mg_http_parse() requires an eight-byte protocol string, so is_http_1_0 is never set. This allows an attacker to smuggle requests through an HTTP/1.0 proxy, which can ignore chunked encoding.

Defensive priority

Organizations using Mongoose versions prior to 7.22 should update to 7.22 to prevent potential unauthorized access or state changes via request smuggling.

Recommended defensive actions

• Update Mongoose to version 7.22 or later
• Review and adjust HTTP/1.0 proxy configurations to prevent request smuggling
• Monitor for suspicious activity related to chunked encoding
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE-2026-73256 issue arises from Mongoose's handling of HTTP/1.0 requests with Transfer-Encoding: chunked and conflicting framing, allowing for request smuggling due to improper processing by the http_cb() function. This issue can be triggered by sending a request with Transfer-Encoding: chunked and conflicting framing to an HTTP/1.0 reverse-proxy deployment. The affected product, Mongoose, is an embedded web server and network library. Users should verify their deployments and review official advisories for affected scope and vendor guidance.

Official resources