Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-73261— Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connection

Quick assessment

Affected
cesanta mongoose
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Mongoose 是一个嵌入式 Web 服务器和网络库。在 7.23 版本之前，通过在 src/net_builtin.c 中启用 MG_ENABLE_TCPIP 而内置的 TCP/IP 协议栈，并未拒绝那些声明长度（opts[1]）超过剩余选项字节数的 TCP 选项。在 handle_opt() 函数中，一个 NOP（无操作）后跟随一个截断的 MSS（最大报文段大小）选项，会导致 opts[3] 被读取到声明选项区域之外，并被用作 dmss 的低字节。未经身份验证的远程对等方可以篡改每个连接的 MSS 值，从而导

CVSS 7.5 · High EPSS 0.35% · P27

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
cesanta mongoose < 7.23 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-73261

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connection
Source: CVE Program / CVE List V5
Vulnerability Description
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP in src/net_builtin.c does not reject a TCP option whose declared opts[1] length exceeds the remaining option bytes. In handle_opt(), a NOP followed by a truncated MSS option causes opts[3] to be read outside the declared options area and used as the low byte of dmss. An unauthenticated remote peer can corrupt the per-connection MSS value so later mg_send() calls transmit truncated or zero-length application payloads while the TCP connection otherwise appears healthy. This issue is fixed in version 7.23.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
cesanta mongoose < 7.23 -

II. Public POCs for CVE-2026-73261

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-73261

请登录查看更多情报信息。

Vendor Pages for CVE-2026-73261 (1)

Other References for CVE-2026-73261 (1)

Same Patch Batch · cesanta · 2026-10-14 · 4 CVEs total

CVE-2026-63626 8.8 HIGH Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB r
CVE-2026-73260 7.5 HIGH Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser
CVE-2026-73252 7.5 HIGH Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one lengt

IV. Related Vulnerabilities

Same product: mongoose
Same vendor: cesanta
Same weakness: CWE-20

V. Comments for CVE-2026-73261

No comments yet

Leave a comment