GHSA-5wfq-r6mr-wqp6: Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling

Q: Which deployments are most exposed to this issue?

Deployments using Mongoose before version 7.22 behind a reverse proxy are exposed when the proxy prefers Content-Length while Mongoose processes Transfer-Encoding: chunked. The desynchronization depends on the proxy and backend interpreting the same request boundary differently.

Q: What does an attacker need to exploit it?

An attacker can be remote and unauthenticated. Exploitation requires sending an HTTP request that includes both Content-Length and Transfer-Encoding: chunked headers to a vulnerable Mongoose HTTP parsing path.

Q: Is a default Mongoose configuration affected?

The available information identifies affected versions as those before 7.22, but does not state whether any particular default deployment configuration is affected. Exposure specifically depends on using a Content-Length-preferring reverse proxy in front of Mongoose.

Q: What is the remediation?

Upgrade Mongoose to version 7.22, which fixes the issue. If upgrading cannot happen immediately, the provided information does not specify a supported mitigation; assess whether the deployment includes a reverse proxy with Content-Length-preferring behavior.

Q: How could exploitation affect users of the application?

A successful request-smuggling attack can inject requests that access or modify resources in another user's context. This can affect confidentiality and integrity of application resources.

Published Aug 20, 2026

Updated

Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The clcount and tecount checks in the mghttpparse() and httpcb() paths in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy can use a different request boundary. This CL.TE desynchronization can inject requests that access or modify resources in another user context. This issue is fixed in version 7.22.

Affected Software

1 affected component

Cesanta Mongoose<7.22

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Mongoose to a version that resolves this vulnerability.
Fixed in 7.22

Event History

Aug 20, 2026

CVE Published

via OSV·05:30 PM

Data Sourced

via OSV·05:30 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are most exposed to this issue?

Deployments using Mongoose before version 7.22 behind a reverse proxy are exposed when the proxy prefers Content-Length while Mongoose processes Transfer-Encoding: chunked. The desynchronization depends on the proxy and backend interpreting the same request boundary differently.

What does an attacker need to exploit it?

An attacker can be remote and unauthenticated. Exploitation requires sending an HTTP request that includes both Content-Length and Transfer-Encoding: chunked headers to a vulnerable Mongoose HTTP parsing path.

Is a default Mongoose configuration affected?

The available information identifies affected versions as those before 7.22, but does not state whether any particular default deployment configuration is affected. Exposure specifically depends on using a Content-Length-preferring reverse proxy in front of Mongoose.

What is the remediation?

Upgrade Mongoose to version 7.22, which fixes the issue. If upgrading cannot happen immediately, the provided information does not specify a supported mitigation; assess whether the deployment includes a reverse proxy with Content-Length-preferring behavior.

How could exploitation affect users of the application?

A successful request-smuggling attack can inject requests that access or modify resources in another user's context. This can affect confidentiality and integrity of application resources.

GHSA-5wfq-r6mr-wqp6: Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are most exposed to this issue?

What does an attacker need to exploit it?

Is a default Mongoose configuration affected?

What is the remediation?

How could exploitation affect users of the application?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most exposed to this issue?

What does an attacker need to exploit it?

Is a default Mongoose configuration affected?

What is the remediation?

How could exploitation affect users of the application?