SB20260812412 - Multiple vulnerabilities in Mongoose

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260812412

SB20260812412 - Multiple vulnerabilities in Mongoose

Published: August 12, 2026 Updated: August 13, 2026

Security Bulletin ID SB20260812412
CSH Severity
High
Patch available
YES
Number of vulnerabilities 10
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 40% Medium 50% Low 10%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 10 vulnerabilities.


1) Cross-site scripting (CVE-ID: CVE-2026-73259)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary JavaScript in the victim\'s browser context.

The vulnerability exists due to cross-site scripting in the listdir() directory listing renderer when rendering a URL-decoded request URI into the <title> and <h1> elements. A remote attacker can send a specially crafted link to execute arbitrary JavaScript in the victim\'s browser context.

User interaction is required to open a crafted link, and the issue is exposed only when directory listing is enabled with MG_ENABLE_DIRLIST.


2) Incorrect Comparison (CVE-ID: CVE-2026-73258)

CWE-ID: CWE-697 - Incorrect Comparison

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass Content-Type-based security filters and corrupt multipart header parsing.

The vulnerability exists due to incorrect comparison in mg_http_next_multipart() when parsing multipart form-data headers and boundaries. A remote attacker can send a specially crafted multipart request to bypass Content-Type-based security filters and corrupt multipart header parsing.

The issue can be triggered by embedding a lone carriage return in a multipart header, which can truncate header values, corrupt filenames, or misidentify boundary lines.


3) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-73257)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information and modify application state.

The vulnerability exists due to inconsistent interpretation of HTTP requests in mg_http_parse() and http_cb() when processing HTTP requests containing both Content-Length and Transfer-Encoding headers. A remote attacker can send a specially crafted request through a CL-preferring proxy to disclose sensitive information and modify application state.

Exploitation requires Mongoose to be deployed behind a reverse proxy that uses Content-Length to determine request boundaries.


4) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-73256)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to smuggle arbitrary requests.

The vulnerability exists due to inconsistent interpretation of HTTP requests in the http_cb() function in mongoose.c when processing HTTP/1.0 requests with a Transfer-Encoding: chunked header behind an HTTP/1.0 proxy. A remote attacker can send a specially crafted request to smuggle arbitrary requests.

Exploitation requires Mongoose to be deployed behind a proxy that uses HTTP/1.0 semantics for backend connections.


5) Path traversal (CVE-ID: CVE-2026-73255)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to path traversal in the mg_ssi() function when processing SSI #include directives in .shtml files. A remote user can inject a crafted include path containing ../ sequences to disclose sensitive information.

Exploitation requires SSI support to be enabled, an ssi_pattern to be configured, and the ability to write or control the contents of an .shtml file.


6) Cross-site scripting (CVE-ID: CVE-2026-73254)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary script in a victim\'s browser.

The vulnerability exists due to cross-site scripting in the printdirentry() directory entry renderer when rendering directory listings with unescaped filenames. A remote attacker can create a file with a specially crafted filename to execute arbitrary script in a victim\'s browser.

Directory listing must be enabled, and user interaction is required to browse the affected directory listing page.


7) Out-of-bounds read (CVE-ID: CVE-2026-52053)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service or disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the rx_ip6() function when parsing crafted IPv6 extension headers. A remote attacker can send a specially crafted IPv6 packet to cause a denial of service or disclose sensitive information.

Exploitation requires access to the same local network segment and affects deployments using the built-in TCP/IP stack with MG_ENABLE_TCPIP enabled.


8) Out-of-bounds read (CVE-ID: CVE-2026-52061)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information or cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the mg_tls_recv_cert() function when parsing a TLS Certificate handshake message. A remote attacker can send a specially crafted Certificate message to disclose sensitive information or cause a denial of service.

The issue can be triggered during the TLS handshake before any application-layer authentication and is also reachable on the server side when mutual TLS processes a malicious client certificate.


9) Out-of-bounds read (CVE-ID: CVE-2026-52068)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the rx_ndp_na() and rx_ndp_ns() NDP message handlers when processing ICMPv6 neighbor advertisement and neighbor solicitation packets. A remote attacker can send a specially crafted NDP packet to cause a denial of service.

Exploitation requires access to the same local network segment, and the issue affects IPv6-enabled interfaces using the built-in TCP/IP stack on bare-metal embedded platforms.


10) Improper Certificate Validation (CVE-ID: CVE-2026-73253)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass TLS hostname verification and perform a man-in-the-middle attack.

The vulnerability exists due to improper certificate validation in the built-in TLS hostname verification logic when comparing certificate SAN/CN values against the expected hostname. A remote attacker can present a wildcard certificate that matches more hostnames than intended to bypass TLS hostname verification and perform a man-in-the-middle attack.

Both SAN and CN verification paths are affected.


Remediation

Install update from vendor's website.

References