Remote Code Execution Vulnerability in Mongoose Web Server by Cesanta

CVE-2026-73256

What is CVE-2026-73256?

Mongoose, a web server and network library, is vulnerable to a remote code execution flaw prior to version 7.22. This vulnerability allows an unauthenticated attacker to exploit HTTP/1.0 reverse proxy configurations by sending specially crafted requests with 'Transfer-Encoding: chunked'. A flaw in the http_cb() function causes the server to mishandle chunked encoding, potentially leading to request smuggling, unauthorized access, or state changes within the application. Users are urged to upgrade to version 7.22 or later to mitigate this security risk.

References