CVE-2026-73260
7.5HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-125
Impact
Remote, unauthenticated attackers can crash your service via an out-of-bounds read during the TLS handshake. This affects servers requiring client certificates or clients connecting to malicious TLS servers.
Root cause
The built-in DER parser mishandles long-form element lengths, underflowing a remaining buffer counter and walking an invalid pointer.
Affected systems
Mongoose prior to 7.23 with MG_TLS_BUILTIN enabled.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade Mongoose to version 7.23 or later. If updating source is delayed, switch from the built-in TLS parser (MG_TLS_BUILTIN) to an external TLS backend like OpenSSL or mbedTLS, or disable client certificate verification if running as a server.
$ git clone --depth 1 --branch 7.23 https://github.com/cesanta/mongoose.gitAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MG_TLS_BUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mg_der_to_tlv() and mg_der_next(), a peer-controlled length can advance the parser beyond the certificate and underflow the remaining uint32_t length, causing mg_tls_parse_cert_der() to continue walking an invalid pointer. An unauthenticated malicious TLS server, or a client presenting a certificate to a server configured for client certificates, can trigger an out-of-bounds read and denial of service during the handshake. This issue is fixed in version 7.23.