Mongoose CVE-2026-73256

Exploitation requires Mongoose (< 7.22) deployed behind an HTTP/1.0 reverse proxy, and the attacker must send an HTTP request using Transfer-Encoding: chunked with conflicting message framing - that specific proxy topology is the concrete precondition stated in the description. No authentication is needed (CVSS PR:N) and no user interaction is required (UI:N), and the attack is remote (AV:N). The primary limiting factor is deployment: if Mongoose is exposed directly, or fronted by a proxy that uses HTTP/1.1 or normalizes/rejects ambiguous Transfer-Encoding vs Content-Length framing, this exact desync does not occur. Impact is bounded to confidentiality and integrity (state changes / unauthorized access); there is no availability impact per the vector.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) describes a remote, unauthenticated, low-complexity attack with high confidentiality and integrity impact and no availability impact, which is consistent with request smuggling used for access-control bypass and state manipulation rather than crashes. The decisive real-world qualifier is deployment topology: exploitation requires Mongoose sitting behind an HTTP/1.0 reverse proxy, so environments that terminate HTTP/1.1+ or expose Mongoose directly are not exposed via this exact desync, which tempers the raw 9.1 for many operators. No EPSS score, KEV listing, or POC was supplied, so there is no evidence of active exploitation or automated weaponization yet; the signals we have are a vendor-confirmed code defect and a released patch, meaning any operator running a vulnerable proxy-fronted deployment should treat this as urgent and prioritize the upgrade, while those not using an HTTP/1.0 proxy can schedule it as routine hardening. Note a mild tension worth verifying: smuggling typically crosses a proxy/back-end trust boundary, which some analysts would model as a scope change (S:C), yet the input vector uses S:U - the assessment below reflects that nuance.

An attacker sends a single crafted HTTP/1.0 request through an internet-facing HTTP/1.0 reverse proxy with a Transfer-Encoding: chunked header and conflicting length framing; the proxy forwards it as one benign request, but Mongoose parses the chunked body and treats trailing bytes as a second, smuggled request. The attacker uses this desync to slip a request past proxy-enforced authentication/authorization or to poison the request pipeline and change server state. No POC was provided in the intelligence, so this reflects the mechanism described in the advisory rather than confirmed public exploit code.