CVE-2026-73260 Details
Description
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MG_TLS_BUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mg_der_to_tlv() and mg_der_next(), a peer-controlled length can advance the parser beyond the certificate and underflow the remaining uint32_t length, causing mg_tls_parse_cert_der() to continue walking an invalid pointer. An unauthenticated malicious TLS server, or a client presenting a certificate to a server configured for client certificates, can trigger an out-of-bounds read and denial of service during the handshake. This issue is fixed in version 7.23.
A vulnerability allowing an out-of-bounds read has been identified in Mongoose versions prior to 7.23. This issue arises in the built-in TLS certificate parser when it processes long-form DER element lengths. The parser fails to properly verify that these lengths fit within the remaining buffer of the certificate. As a result, a peer-controlled length can cause the parser to read beyond the certificate boundaries, leading to a memory underflow. This flaw can be exploited by an unauthenticated malicious TLS server, or by a client presenting a certificate to a server that requires client certificates, during the TLS handshake. The exploitation causes a denial-of-service by crashing the application on platforms with a memory management unit (MMU).
Users can upgrade to Mongoose version 7.23, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cesanta/mongoose/commit/a8b4ae95db3c2db85e5ad9db3fefaeebb5f7b43e | [email protected] | Source CodeVendor |
| https://github.com/cesanta/mongoose/releases/tag/7.23 | [email protected] | Release NotesVendor |
| https://github.com/cesanta/mongoose/security/advisories/GHSA-f6wr-mg35-p25g | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Cesanta Mongoose | 7.22 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |