Mongoose EUVD-2026-63495

Exploitation requires that the target application built on Mongoose exposes an HTTP endpoint that processes multipart/form-data input using mg_http_next_multipart(), which is a standard pattern for any file upload feature. No authentication is required per the CVSS vector (PR:N), and no special non-default Mongoose configuration is needed - multipart processing is part of the library's core HTTP handling. The primary factor limiting impact is that the vulnerability produces content-type spoofing and header truncation rather than direct memory corruption or code execution; practical harm depends on whether the embedding application makes security-relevant decisions (file type gating, content filtering) based on the parser's output. Only Mongoose versions prior to 7.22 are affected; version 7.22 and later correctly require the full two-byte CRLF sequence for loop termination.

The CVSS 6.5 score with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N reflects genuine unauthenticated network exploitability at low attack complexity, which is an accurate characterization of the threat surface: any HTTP endpoint that accepts multipart/form-data is reachable without credentials. No EPSS data was included in the source intelligence, and the vulnerability does not appear in the CISA KEV catalog, so no confirmed active exploitation can be stated. The practical impact is bounded - the vulnerability enables content-type spoofing and header truncation rather than direct code execution or data exfiltration, meaning harm depends on how the embedding application uses the parser output. The C:L and I:L ratings are reasonable given that a spoofed Content-Type could enable upload of disallowed file types or injection of crafted content, while the absence of A impact is consistent with no crash or denial-of-service path being described. This is a real patching priority for any embedded application processing file uploads, but the lack of exploit code and KEV listing suggests it is not currently being mass-targeted.

An unauthenticated remote attacker sends an HTTP POST request to a Mongoose-hosted file upload endpoint with a crafted multipart body containing a lone carriage return positioned before the actual Content-Type header value. The premature loop termination in mg_http_next_multipart() causes the parser to return a truncated or spoofed Content-Type, leading the application to classify the upload as an innocuous type such as text/plain when the actual content is an executable script, bypassing upload validation logic. No public proof-of-concept has been identified, but the attack requires only standard HTTP tooling and knowledge of multipart encoding.