TCP/IP Stack Vulnerability in Mongoose Embedded Web Server

CVE-2026-73261

What is CVE-2026-73261?

The Mongoose embedded web server prior to version 7.23 contains an improper input validation vulnerability within its built-in TCP/IP stack, specifically when enabled with MG_ENABLE_TCPIP. The handler for TCP options does not properly check the length of the options specified, which may allow an unauthenticated remote peer to send malformed options. This could potentially lead to the corruption of the maximum segment size (MSS) for active connections. Consequently, this allows attackers to disrupt the data transmission process, causing the application payloads to be truncated or empty, even while maintaining the appearance of a healthy TCP connection.

References