critical
CVE-2026-73257
Mongoose is an embedded web server and network library. Priro to versi ...
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
Julia9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Trivy's own label is CRITICAL. Rated critical by Julia.
Description
Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_http_parse() and http_cb() paths in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy can use a different request boundary. This CL.TE desynchronization can inject requests that access or modify resources in another user context. This issue is fixed in version 7.22.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | Mongoose_jll | no fix listed |
| debian 14 | mongoose | 7.22+ds-1 |
| rapidfort fedora 43 | mongoose, mongoose-devel, mongoose-lib | 3.1-30.fc43 |
Show all 5 entries from 3 sources
| Source | Package | Fixed in |
|---|---|---|
| julia::Julia Ecosystem Security Advisories | Mongoose_jll | no fix listed |
| debian 14 | mongoose | 7.22+ds-1 |
| rapidfort fedora 43 | mongoose | 3.1-30.fc43 |
| rapidfort fedora 43 | mongoose-devel | 3.1-30.fc43 |
| rapidfort fedora 43 | mongoose-lib | 3.1-30.fc43 |