CVE-2026-115473

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 7.22

Description An issue exists in the mg path is sane() function within src/util.c where the system reads path.buf[1] without verifying that path.len is at least two bytes, and reads s[2] when only two bytes remain. Unauthenticated remote requests targeting the mg http upload or mg http serve dir endpoints with specific short path shapes can trigger one-byte heap out-of-bounds reads. On bare-metal or RTOS (Real-Time Operating System) targets lacking memory protection, this may expose adjacent bytes or affect path acceptance, while instrumented builds may crash.

Recommendations Update to version 7.22.