Remote Code Injection Vulnerability in Mongoose Web Server

CVE-2026-73257

What is CVE-2026-73257?

Mongoose, an embedded web server and network library, has a vulnerability where prior to version 7.22, a remote unauthenticated attacker can exploit an HTTP request containing both Content-Length and Transfer-Encoding: chunked. Due to desynchronization of these headers, malicious requests can access or modify resources in another user's context, posing significant security risks. The issue is addressed in version 7.22.

References