Heap Out-of-Bounds Read in Mongoose TLS Stack

CVE-2026-73252

What is CVE-2026-73252?

Mongoose, an embedded web server and network library, prior to version 7.23, has a vulnerability in its built-in TLS stack where it improperly processes a TLS 1.3 record. This record may consist solely of the 16-byte authentication tag without any accompanying plaintext or ContentType byte. The vulnerability arises when the length check in the mg_tls_recv_record() function allows an out-of-bounds read, enabling an unauthenticated malicious TLS peer to exploit the condition, which can trigger a remote denial of service due to the underflow in recv_len calculation. This issue is addressed in version 7.23.

References