Summary
CVE-2026-73257 is an HTTP request smuggling vulnerability in Cesanta Mongoose, a lightweight embedded web server/networking library. Mongoose accepts HTTP requests that contain both a Content-Length and a Transfer-Encoding header at the same time, violating RFC 7230, which allows a remote unauthenticated attacker to desynchronize Mongoose from a front-end reverse proxy. The issue carries a CVSS v3.1 base score of 9.1 (Critical).
Technical details
- Root cause: Mongoose does not reject HTTP requests where both
Content-LengthandTransfer-Encodingheaders are present, and internally prioritizesTransfer-Encoding: chunkedframing overContent-Length. - Trigger condition: A reverse proxy or load balancer placed in front of Mongoose that instead honors
Content-Lengthwill disagree with Mongoose about where one request ends and the next begins (a CL.TE desynchronization). - Attack vector: Network, no authentication or user interaction required — the attacker only needs to send a crafted HTTP request through the proxy to the Mongoose backend.
- Impact: An attacker can smuggle a hidden request that Mongoose processes but the proxy attributes to a different, unrelated client connection, potentially allowing access to or modification of resources in another user’s context (high confidentiality and integrity impact; no availability impact).
Affected software
- Cesanta Mongoose version 7.21 (fixed in version 7.22)
Severity
- CVSS v3.1 Base Score: 9.1 (Critical)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Mitigation and recommended actions
- Immediate: Upgrade Cesanta Mongoose to version 7.22 or later, which rejects requests containing both
Content-LengthandTransfer-Encodingheaders. - If patching is not immediately possible: Configure any reverse proxy or load balancer in front of Mongoose to reject or normalize requests that contain both
Content-LengthandTransfer-Encodingheaders, and ensure the proxy’s request-framing behavior matches Mongoose’s until the upgrade is applied.

