kritisch
CVE-2026-73257
Mongoose is an embedded web server and network library. Priro to versi ...
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
Julia9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Trivys eigenes Label ist CRITICAL. Kritisch laut Julia.
Beschreibung
Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_http_parse() and http_cb() paths in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy can use a different request boundary. This CL.TE desynchronization can inject requests that access or modify resources in another user context. This issue is fixed in version 7.22.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | Mongoose_jll | kein Fix angegeben |
| debian 14 | mongoose | 7.22+ds-1 |
| rapidfort fedora 43 | mongoose, mongoose-devel, mongoose-lib | 3.1-30.fc43 |
Alle 5 Einträge aus 3 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | Mongoose_jll | kein Fix angegeben |
| debian 14 | mongoose | 7.22+ds-1 |
| rapidfort fedora 43 | mongoose | 3.1-30.fc43 |
| rapidfort fedora 43 | mongoose-devel | 3.1-30.fc43 |
| rapidfort fedora 43 | mongoose-lib | 3.1-30.fc43 |