CVE-2026-6986

A vulnerability in Mongoose before version 7.22 allows a remote unauthenticated attacker to send an HTTP request with both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks accept both headers and prioritize chunked encoding, leading to CL.TE desynchronization and request injection in another user's context.

A vulnerability in Mongoose before version 7.22 allows a remote unauthenticated attacker to exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http_cb() function tests hm.proto.len with an impossible greater-than-eight condition, so is_http_1_0 is never set, and Mongoose processes chunked encoding that an HTTP/1.0 proxy can ignore.

A vulnerability in Mongoose before version 7.22 allows an on-path network attacker with a wildcard certificate for a parent domain to impersonate deeper subdomains to a client using the built-in TLS stack. The mg_tls_verify_cert_san() and mg_tls_verify_cert_cn() functions call mg_match(), whose wildcard can cross DNS label boundaries, so a pattern like *.example.com can match foo.bar.example.com.

A vulnerability in Mongoose before version 7.23 allows a network attacker to impersonate a TLS server to a Mongoose client configured with a multi-certificate CA bundle. The mg_tls_init() function stores the bundle in tls->ca_bundle_der while tls->ca_der.len remains zero, and mg_tls_recv_cert() uses tls_bundle_find() to accept a Common Name match without verifying the certificate signature.

Mongoose, an embedded web server and network library, prior to 7.23 does not reject a TCP option whose declared opts[1] length exceeds the remaining option bytes. In handle_opt(), a NOP followed by a truncated MSS option causes opts[3] to be read outside the declared options area and used as the low byte of dmss. An unauthenticated remote peer can corrupt the per-connection MSS value so later mg_send() calls transmit truncated or zero-length application payloads while the TCP connection otherwise appears healthy.

Mongoose, an embedded web server and network library, prior to 7.23 has a built-in TLS certificate parser selected by MG_TLS_BUILTIN that fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mg_der_to_tlv() and mg_der_next(), a peer-controlled length can advance the parser beyond the certificate and underflow the remaining uint32_t length, causing mg_tls_parse_cert_der() to continue walking an invalid pointer. An unauthenticated malicious TLS server, or a client presenting a certificate to a server configured for client certificates, can trigger an out-of-bounds read and denial of service during the handshake.

Mongoose, an embedded web server and network library, prior to 7.23 has a built-in TLS stack selected by MG_TLS_BUILTIN in src/tls_builtin.c that accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no plaintext or ContentType byte. In mg_tls_recv_record(), the msgsz length check permits that record and the recv_len calculation underflows to SIZE_MAX, so a later handshake step treats stale buffer contents as a trusted message with an effectively unbounded length. An unauthenticated malicious TLS peer can trigger a heap out-of-bounds read before certificate or Finished validation, causing a remote denial of service.

Mongoose, an embedded web server and network library, prior to 7.23 has ppp_handle_ipv6cp() in src/l2_ppp.c that trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MG_ENABLE_TCPIP and MG_ENABLE_IPV6, an unauthenticated adjacent peer can complete the required LCP exchange and send a short Configure-Request with an oversized length, causing ppp_tx_frame() to read beyond recv_queue.buf and write beyond tx.buf. The same length misuse can also expose adjacent heap bytes in a reply or hang the event loop through find_opt().

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MG_ENABLE_DIRLIST and persuade a user to visit it. The mg_http_serve_dir() and listdir() path in src/http.c places the decoded request URI into the title and h1 elements without HTML entity encoding. The resulting reflected cross-site scripting executes in the Mongoose origin and can expose session data or perform actions as the victim. This issue is fixed in version 7.22.

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mg_http_next_multipart() in src/http.c. The loops comparing s[b] and s[b + 1], and s[h2] and s[h2 + 1], use an incorrect AND condition and stop when either character resembles part of a CRLF terminator. This truncates headers, filenames, or boundaries and can cause an application to accept dangerous content after seeing a misleading Content-Type value. This issue is fixed in version 7.22.