EUVD-2026-63492Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Network and unauthenticated (AV:N/PR:N), but exploitation depends on a specific CL-preferring front-end proxy topology, so AC:H rather than AC:L; smuggling reads/modifies other users' requests giving C:H/I:H, no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_http_parse() and http_cb() paths in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy can use a different request boundary. This CL.TE desynchronization can inject requests that access or modify resources in another user context. This issue is fixed in version 7.22.
AnalysisAI
HTTP request smuggling (CL.TE desynchronization) in Cesanta Mongoose embedded web server before 7.22 lets a remote unauthenticated attacker craft a request bearing both Content-Length and Transfer-Encoding: chunked headers. Because mg_http_parse()/http_cb() accept both and prioritize chunked encoding while a front-end reverse proxy that prefers Content-Length draws a different request boundary, an attacker can smuggle a second request that reads or modifies resources belonging to another user's context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the vulnerable Mongoose instance (pre-7.22) sits behind a reverse proxy or load balancer that resolves request length using Content-Length while Mongoose prioritizes Transfer-Encoding: chunked - this interpretation mismatch IS the required condition. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) presents this as a network-reachable, unauthenticated, low-complexity issue with high confidentiality and integrity impact and no availability impact - consistent with smuggling that reads/alters other users' requests but does not crash the service. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends a single HTTP request to a Mongoose-backed application fronted by a Content-Length-preferring reverse proxy, including both a Content-Length header and Transfer-Encoding: chunked. The proxy forwards what it considers one request while Mongoose parses the chunked body and treats trailing bytes as the start of a second, smuggled request, which is then attributed to another user's connection - allowing the attacker to poison responses, hijack requests, or access/modify resources in another user's context. … |
| Remediation | Upgrade to Mongoose 7.22, which is the vendor-released patch (fixed via PR #3611 / commit a9df523f76f43a38bd53b4232b9cfd4c16869e71, tagged release https://github.com/cesanta/mongoose/releases/tag/7.22); the fix makes mg_http_parse() reject any request carrying both Content-Length and Transfer-Encoding. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a comprehensive inventory of all Mongoose deployments across production, staging, and development environments to identify instances running versions prior to 7.22; prioritize internet-facing and customer-facing systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Mongoose ODM for Node.js before version 8.9.5 contains a search injection vulnerability when using $where filters with p
An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6
An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8. Rated crit
An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8.
An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8.
Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4. Rated critical severity (CVSS 9.8), this vu
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6. Rated critical severity (CVSS 9.8), this vu
An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infin
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. Rated critical severity (CVSS 9.1
The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 (compiled with OpenSSL support) is vulnerable to remote OO
The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable
The mg_http_serve_file function in Cesanta Mongoose HTTP server 7.0 is vulnerable to remote OOB write attack via connect
Same weakness CWE-444 – HTTP Request/Response Smuggling
View allSame technique Request Smuggling
View allShare
External POC / Exploit Code
Leaving vuln.today