CVE-2026-115473: Mongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c)
Mongoose is an embedded web server and network library. Prior to 7.22, mgpathissane in src/util.c read path.buf[1] without first requiring path.len to be at least two and read s[2] when only two bytes remained. Unauthenticated remote requests reaching mghttpupload or mghttpservedir with the affected short path shapes could therefore trigger one-byte heap out-of-bounds reads. On bare-metal or RTOS targets without memory protection, the adjacent byte could be exposed or influence whether a path was accepted, and instrumented builds could crash. This issue is fixed in version 7.22.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mongooseto a version that resolves this vulnerability.Fixed in 7.22
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Deployments that expose mg_http_upload or mg_http_serve_dir to remote requests are affected if they use a Mongoose version prior to 7.22. Bare-metal and RTOS targets without memory protection face the greatest potential impact because an adjacent heap byte may be exposed or may affect path acceptance.
Does exploitation require authentication or user interaction?
No. The issue can be reached through unauthenticated remote requests with affected short path shapes, and it does not require user interaction.
What can happen if the vulnerable code is reached?
Affected requests can cause one-byte heap out-of-bounds reads. Instrumented builds may crash; on bare-metal or RTOS systems without memory protection, the read may disclose an adjacent byte or influence whether a path is accepted.
How can I remediate the issue?
Upgrade Mongoose to version 7.22, which fixes the issue. The provided data does not specify an alternative mitigation for deployments that cannot be upgraded immediately.