Vulnerability · Published Oct 14, 2026 · Assigned by GitHub_M
CVE-2026-73261Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connection
High 7.5
In plain English
A high-severity improper input validation in mongoose from cesanta. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP in src/net_builtin.c does not reject a TCP option whose declared opts[1] length exceeds the remaining option bytes. In handle_opt(), a NOP followed by a truncated MSS option causes opts[3] to be read outside the declared options area and used as the low byte of dmss. An unauthenticated remote peer can corrupt the per-connection MSS value so later mg_send() calls transmit truncated or zero-length application payloads while the TCP connection otherwise appears healthy. This issue is fixed in version 7.23.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | mongoose | 7.23+ds-1 | DEBIAN-CVE-2026-73261 |
| Ubuntu:26.10 | mongoose | no fix listed | UBUNTU-CVE-2026-73261 |
Affected products (as reported)
Weakness: CWE-20, CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/cesanta/mongoose/security/advisories/GHSA-3fmr-92g4-wchx x_refsource_CONFIRM
- https://github.com/cesanta/mongoose/commit/cc7c6d2d18c28fcc6d085633dddd88402946140a x_refsource_MISC
- https://github.com/cesanta/mongoose/releases/tag/7.23 x_refsource_MISC