CVE-2026-73252 Details
Description
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MG_TLS_BUILTIN in src/tls_builtin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no plaintext or ContentType byte. In mg_tls_recv_record(), the msgsz length check permits that record and the recv_len calculation underflows to SIZE_MAX, so a later handshake step treats stale buffer contents as a trusted message with an effectively unbounded length. An unauthenticated malicious TLS peer can trigger a heap out-of-bounds read before certificate or Finished validation, causing a remote denial of service. This issue is fixed in version 7.23.
A heap out-of-bounds read vulnerability has been identified in the built-in TLS stack of Mongoose, an embedded web server and network library, prior to version 7.23. The issue arises in the TLS 1.3 record handling, where a record with a decrypted size of exactly 16 bytes (a valid authentication tag with no plaintext or ContentType byte) is improperly processed. The length check in the 'mg_tls_recv_record()' function allows this record, causing a buffer underflow that is exploited to read stale data as a trusted message. This vulnerability can be triggered by an unauthenticated malicious TLS peer, leading to a remote denial-of-service condition.
Users can upgrade to Mongoose version 7.23 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cesanta/mongoose/security/advisories/GHSA-hq58-98f5-2wg3 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/cesanta/mongoose/commit/758e301f0c9a9885c1b716195df5fe6d6ac9d53e | [email protected] | Source CodeVendor |
| https://github.com/cesanta/mongoose/releases/tag/7.23 | [email protected] | Release NotesVendor |
| https://github.com/cesanta/mongoose/security/advisories/GHSA-hq58-98f5-2wg3 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
| CWE-191 | Integer Underflow (Wrap or Wraparound) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Cesanta Mongoose | <= 7.22 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |