Heap Out-of-Bounds Read in Mongoose Web Server Prior to Version 7.22

CVE-2026-115473

What is CVE-2026-115473?

The Mongoose web server and networking library contains a vulnerability where certain functions can lead to heap out-of-bounds reads due to insufficient path length validation. Specifically, the function mg_path_is_sane fails to check that the path length is appropriate before accessing memory, allowing unauthenticated remote requests to potentially trigger these reads. This could impact systems without memory protection, exposing sensitive data or causing application crashes. Users are recommended to update to version 7.22 or later to mitigate these risks.

References