CVE-2026-73257: Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling
Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The clcount and tecount checks in the mghttpparse() and httpcb() paths in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy can use a different request boundary. This CL.TE desynchronization can inject requests that access or modify resources in another user context. This issue is fixed in version 7.22.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mongoose (embedded web server and network library)to a version that resolves this vulnerability.Fixed in 7.22
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Mongoose deployments before version 7.22 are affected when they sit behind a reverse proxy that prefers Content-Length while Mongoose processes Transfer-Encoding: chunked. The differing request-boundary interpretation enables CL.TE desynchronization.
What does an attacker need to exploit the vulnerability?
An attacker needs only remote network access and does not need authentication or user interaction. They must be able to send an HTTP request containing both Content-Length and Transfer-Encoding: chunked headers.
What is the practical impact of successful exploitation?
A successful request-smuggling attack can inject requests that access or modify resources in another user's context. Confidentiality and integrity are affected, while no availability impact is specified.
What should be done if the affected version cannot be upgraded immediately?
The provided information identifies version 7.22 as the fix. It does not specify a workaround; prioritize preventing requests with both Content-Length and Transfer-Encoding: chunked from reaching the affected Mongoose service, particularly through Content-Length-preferring reverse proxies.