Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-73252— Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAX

Quick assessment

Affected
cesanta mongoose
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Mongoose 是一个嵌入式 Web 服务器和网络库。在 7.23 版本之前，由 中 配置启用的内置 TLS 堆栈会接受一种特殊的 TLS 1.3 记录：其解密后的数据长度恰好等于 16 字节的认证标签（authentication tag），且不包含任何明文数据或 ContentType 字节。在 函数中，对消息长度 的检查未能正确拒绝此类记录，导致接收长度 的计算发生下溢，变为 。这使得后续的握手步骤将缓冲区中的陈旧数据视为一个可信消息，并赋予其一个近乎无限长的有效长度。未经身份验证的恶意 TLS 对端可利用

CVSS 7.5 · High EPSS 0.38% · P30

Affected Version Matrix 1

VendorProduct Version RangeStatus
cesanta mongoose < 7.23 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-73252

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAX
Source: CVE Program / CVE List V5
Vulnerability Description
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MG_TLS_BUILTIN in src/tls_builtin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no plaintext or ContentType byte. In mg_tls_recv_record(), the msgsz length check permits that record and the recv_len calculation underflows to SIZE_MAX, so a later handshake step treats stale buffer contents as a trusted message with an effectively unbounded length. An unauthenticated malicious TLS peer can trigger a heap out-of-bounds read before certificate or Finished validation, causing a remote denial of service. This issue is fixed in version 7.23.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数下溢(超界折返)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
cesanta mongoose < 7.23 -

II. Public POCs for CVE-2026-73252

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-73252

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-73252 (1)

Vendor Pages for CVE-2026-73252 (1)

Other References for CVE-2026-73252 (1)

Same Patch Batch · cesanta · 2026-10-14 · 4 CVEs total

CVE-2026-63626 8.8 HIGH Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB r
CVE-2026-73261 7.5 HIGH Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, sil
CVE-2026-73260 7.5 HIGH Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser

IV. Related Vulnerabilities

Same product: mongoose
Same vendor: cesanta
Same weakness: CWE-191

V. Comments for CVE-2026-73252

No comments yet

Leave a comment