CVE-2026-73257

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 7.22

Description A remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked headers. The cl count and te count checks within the mg http parse() and http cb() functions in src/http.c accept both headers but prioritize chunked encoding. If a reverse proxy prefers Content-Length, a CL.TE desynchronization occurs, allowing the attacker to inject requests that access or modify resources in another user context. CL.TE desynchronization is a type of request smuggling where the front-end and back-end servers disagree on where a request ends.

Recommendations Update to version 7.22.