CVE-2026-73258: Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart
Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mghttpnextmultipart() in src/http.c. The loops comparing s[b] and s[b + 1], and s[h2] and s[h2 + 1], use an incorrect AND condition and stop when either character resembles part of a CRLF terminator. This truncates headers, filenames, or boundaries and can cause an application to accept dangerous content after seeing a misleading Content-Type value. This issue is fixed in version 7.22.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mongoose (mg_http_next_multipart)to a version that resolves this vulnerability.Fixed in 7.22
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using Mongoose before version 7.22 are exposed if they process attacker-controlled multipart input through mg_http_next_multipart() in src/http.c.
What does an attacker need to exploit this issue?
The attacker can exploit the flaw remotely without authentication or user interaction by supplying multipart input containing a lone carriage return or line feed.
What is the impact on an application?
Malformed multipart input can truncate parsed headers, filenames, or boundaries. This may cause the application to accept dangerous content after observing a misleading Content-Type value.
What should be done if patching is not immediately possible?
The provided information does not specify a workaround. Limit or reject untrusted multipart input processed by mg_http_next_multipart() until Mongoose can be updated to 7.22.