CVE-2026-73258

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 7.22

Description A remote attacker can insert a lone carriage return or line feed into multipart input processed by the mg http next multipart() function in src/http.c. The logic used to compare characters in the loops fails due to an incorrect AND condition, causing the process to stop when any character resembles part of a CRLF (Carriage Return Line Feed) terminator. This results in the truncation of boundaries, filenames, or headers, which may lead an application to accept malicious content by relying on a misleading Content-Type value.

Recommendations Update to version 7.22. As a temporary workaround, restrict the use of the mg http next multipart() function until the update is applied.