Homepage

HTTP Request Smuggling Affecting mongoose package, versions <7.22+ds-1

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.4% (34th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIANUNSTABLE-MONGOOSE-19186430
  • published22 Aug 2026
  • disclosed20 Aug 2026
Report a new vulnerability Found a mistake?

Introduced: 20 Aug 2026

NewCVE-2026-73256  (opens in a new tab)
CWE-444  (opens in a new tab)

How to fix?

Upgrade Debian:unstable mongoose to version 7.22+ds-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream mongoose package and not the mongoose package as distributed by Debian. See How to fix? for Debian:unstable relevant fixed versions and status.

Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http_cb() function in src/http.c tests hm.proto.len with an impossible greater-than-eight condition even though mg_http_parse() requires an eight-byte protocol string, so is_http_1_0 is never set. Mongoose consequently processes chunked encoding that an HTTP/1.0 proxy can ignore, enabling request smuggling and unauthorized access or state changes. This issue is fixed in version 7.22.