CVE-2026-73261 Details
Description
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP in src/net_builtin.c does not reject a TCP option whose declared opts[1] length exceeds the remaining option bytes. In handle_opt(), a NOP followed by a truncated MSS option causes opts[3] to be read outside the declared options area and used as the low byte of dmss. An unauthenticated remote peer can corrupt the per-connection MSS value so later mg_send() calls transmit truncated or zero-length application payloads while the TCP connection otherwise appears healthy. This issue is fixed in version 7.23.
A denial-of-service vulnerability has been identified in Mongoose versions prior to 7.23, within the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP. The issue arises in the TCP option handling, where the 'handle_opt()' function in 'src/net_builtin.c' fails to properly validate the length of TCP options. This oversight allows an unauthenticated remote peer to manipulate the Maximum Segment Size (MSS) value for a TCP connection. Exploitation of this vulnerability causes application data sent over the connection to be truncated or lost, while the TCP connection itself remains intact and functional.
Users can upgrade to Mongoose version 7.23, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cesanta/mongoose/security/advisories/GHSA-3fmr-92g4-wchx | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/cesanta/mongoose/commit/cc7c6d2d18c28fcc6d085633dddd88402946140a | [email protected] | Source CodeVendor |
| https://github.com/cesanta/mongoose/releases/tag/7.23 | [email protected] | Release NotesVendor |
| https://github.com/cesanta/mongoose/security/advisories/GHSA-3fmr-92g4-wchx | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
| CWE-20 | Improper Input Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Cesanta Mongoose | <= 7.22 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |