Summary
CVE-2026-73256 is a critical HTTP request smuggling vulnerability (CWE-444: Inconsistent Interpretation of HTTP Requests) affecting the Cesanta Mongoose embedded network library. The flaw lies in Mongoose’s HTTP/1.0 detection logic, which fails to correctly identify HTTP/1.0 requests, allowing chunked Transfer-Encoding to be improperly accepted in violation of RFC 7230. With a CVSS v3.1 base score of 9.1 (Critical), this issue can be exploited remotely without authentication when Mongoose is deployed behind a reverse proxy.
Technical details
- Root cause: in
http_cb()withinmongoose.c, the condition used to set theis_http_1_0flag relies on a comparison (proto.len > 8) that can never be true, because Mongoose’s HTTP parser always enforces a protocol string length of exactly 8 characters (e.g., "HTTP/1.0"). As a result,is_http_1_0is never set to true. - Effect: because the flag is never set, the code path meant to reject "Transfer-Encoding: chunked" on HTTP/1.0 requests never executes, so chunked encoding is accepted even on HTTP/1.0 requests.
- Trigger conditions: Mongoose is deployed behind a front-end proxy that itself treats the request as HTTP/1.0 and interprets framing (Content-Length) differently than Mongoose, which will parse the chunked body.
- Attack vector: network, no privileges or user interaction required. An attacker sends a crafted request with conflicting Content-Length/Transfer-Encoding framing to create a CL.TE request smuggling condition between the proxy and Mongoose.
- Impact: allows bypassing proxy-level filtering/access controls and desynchronizing the request stream between proxy and backend, with high impact to confidentiality and integrity of subsequent requests processed by the smuggled channel.
Affected software
- Cesanta Mongoose version 7.21 and prior versions containing the flawed HTTP/1.0 detection logic (all versions prior to 7.22)
Severity
- CVSS v3.1 Base Score: 9.1 (Critical)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Mitigation and recommended actions
- Immediate: Upgrade to Mongoose version 7.22 or later, which fixes the HTTP/1.0 detection logic.
- If immediate patching is not possible: avoid placing HTTP/1.0-capable reverse proxies in front of vulnerable Mongoose instances, and disable or reject chunked Transfer-Encoding at the proxy layer; ensure the proxy and Mongoose use consistent HTTP framing (Content-Length vs. Transfer-Encoding) enforcement to eliminate desynchronization opportunities.
How IONIX identifies potentially affected assets
IONIX matches the following signals against data already collected when it crawled the asset; identifying the technology sends no request beyond that crawl.
- Server response header:
Mongoose

