CVE-2026-73256

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 7.22

Description A remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http cb() function in src/http.c contains a logic error where it tests hm.proto.len with an impossible greater-than-eight condition, despite mg http parse() requiring an eight-byte protocol string. This prevents is http 1 0 from being set, causing Mongoose to process chunked encoding that an HTTP/1.0 proxy might ignore. This discrepancy enables request smuggling, which can lead to unauthorized access or state changes.

Recommendations Update to version 7.22.