EUVD-2026-63495Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Multipart endpoint is network-reachable without credentials or interaction; impact is limited to content-type spoofing with no code execution or availability loss.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mg_http_next_multipart() in src/http.c. The loops comparing s[b] and s[b + 1], and s[h2] and s[h2 + 1], use an incorrect AND condition and stop when either character resembles part of a CRLF terminator. This truncates headers, filenames, or boundaries and can cause an application to accept dangerous content after seeing a misleading Content-Type value. This issue is fixed in version 7.22.
AnalysisAI
Multipart body parsing in Cesanta Mongoose before 7.22 can be manipulated by a remote unauthenticated attacker to truncate headers, filenames, or boundary values through injection of a lone carriage return or line feed. The logic error in mg_http_next_multipart() causes CRLF-scanning loops to terminate prematurely on any single CR or LF character rather than requiring the full two-byte CRLF sequence, enabling content-type spoofing that can cause downstream application logic to accept dangerous or disallowed content. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application built on Mongoose exposes an HTTP endpoint that processes multipart/form-data input using mg_http_next_multipart(), which is a standard pattern for any file upload feature. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 score with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N reflects genuine unauthenticated network exploitability at low attack complexity, which is an accurate characterization of the threat surface: any HTTP endpoint that accepts multipart/form-data is reachable without credentials. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated remote attacker sends an HTTP POST request to a Mongoose-hosted file upload endpoint with a crafted multipart body containing a lone carriage return positioned before the actual Content-Type header value. The premature loop termination in mg_http_next_multipart() causes the parser to return a truncated or spoofed Content-Type, leading the application to classify the upload as an innocuous type such as text/plain when the actual content is an executable script, bypassing upload validation logic. … |
| Remediation | Upgrade Cesanta Mongoose to version 7.22 or later, which contains the corrected CRLF detection logic in both affected loops within mg_http_next_multipart(). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Mongoose ODM for Node.js before version 8.9.5 contains a search injection vulnerability when using $where filters with p
An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6
An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8. Rated crit
An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8.
An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8.
Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4. Rated critical severity (CVSS 9.8), this vu
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6. Rated critical severity (CVSS 9.8), this vu
An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infin
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. Rated critical severity (CVSS 9.1
The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 (compiled with OpenSSL support) is vulnerable to remote OO
The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable
The mg_http_serve_file function in Cesanta Mongoose HTTP server 7.0 is vulnerable to remote OOB write attack via connect
Same weakness CWE-697 – Incorrect Comparison
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today