EUVD-2026-63497Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Remote and unauthenticated (AV:N/PR:N), but requires a specific HTTP/1.0 reverse-proxy deployment so AC:H; smuggling crosses the proxy trust boundary so S:C; high confidentiality/integrity, no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http_cb() function in src/http.c tests hm.proto.len with an impossible greater-than-eight condition even though mg_http_parse() requires an eight-byte protocol string, so is_http_1_0 is never set. Mongoose consequently processes chunked encoding that an HTTP/1.0 proxy can ignore, enabling request smuggling and unauthorized access or state changes. This issue is fixed in version 7.22.
AnalysisAI
HTTP request smuggling in Cesanta Mongoose embedded web server/network library before 7.22 lets a remote unauthenticated attacker desynchronize an HTTP/1.0 reverse-proxy front-end from the Mongoose back-end. A buggy length check in http_cb() (src/http.c) never sets is_http_1_0, so Mongoose honors Transfer-Encoding: chunked framing that an HTTP/1.0 proxy ignores, allowing the attacker to smuggle requests past the proxy and reach unauthorized functionality or alter application state. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires Mongoose (< 7.22) deployed behind an HTTP/1.0 reverse proxy, and the attacker must send an HTTP request using Transfer-Encoding: chunked with conflicting message framing - that specific proxy topology is the concrete precondition stated in the description. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, 9.1) describes a remote, unauthenticated, low-complexity attack with high confidentiality and integrity impact and no availability impact, which is consistent with request smuggling used for access-control bypass and state manipulation rather than crashes. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends a single crafted HTTP/1.0 request through an internet-facing HTTP/1.0 reverse proxy with a Transfer-Encoding: chunked header and conflicting length framing; the proxy forwards it as one benign request, but Mongoose parses the chunked body and treats trailing bytes as a second, smuggled request. The attacker uses this desync to slip a request past proxy-enforced authentication/authorization or to poison the request pipeline and change server state. … |
| Remediation | Vendor-released patch: upgrade to Mongoose 7.22, which fixes the framing check and additionally rejects requests containing both Content-Length and Transfer-Encoding headers (see release https://github.com/cesanta/mongoose/releases/tag/7.22 and advisory GHSA-mgp5-rjrv-h5j3). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Mongoose versions prior to 7.22, prioritizing production deployments behind HTTP/1.0 reverse proxies. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Mongoose ODM for Node.js before version 8.9.5 contains a search injection vulnerability when using $where filters with p
An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6
An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8. Rated crit
An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8.
An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8.
Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4. Rated critical severity (CVSS 9.8), this vu
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6. Rated critical severity (CVSS 9.8), this vu
An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infin
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. Rated critical severity (CVSS 9.1
The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 (compiled with OpenSSL support) is vulnerable to remote OO
The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable
The mg_http_serve_file function in Cesanta Mongoose HTTP server 7.0 is vulnerable to remote OOB write attack via connect
Same weakness CWE-444 – HTTP Request/Response Smuggling
View allSame technique Request Smuggling
View allShare
External POC / Exploit Code
Leaving vuln.today