CVE-2026-73261
7.5HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-20, CWE-125
Impact
Remote unauthenticated attackers can cause a denial of service by corrupting per-connection MSS values, resulting in zero-length or truncated data transmission. They only need network connectivity to send malformed TCP packets to the affected service.
Root cause
The built-in TCP/IP stack fails to validate option lengths, causing handle_opt() to read out-of-bounds bytes when handling truncated MSS options.
Affected systems
Mongoose prior to 7.23 with MG_ENABLE_TCPIP enabled
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade Mongoose to version 7.23 or later. If upgrading immediately is not possible, disable the built-in TCP/IP stack by compiling without MG_ENABLE_TCPIP.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP in src/net_builtin.c does not reject a TCP option whose declared opts[1] length exceeds the remaining option bytes. In handle_opt(), a NOP followed by a truncated MSS option causes opts[3] to be read outside the declared options area and used as the low byte of dmss. An unauthenticated remote peer can corrupt the per-connection MSS value so later mg_send() calls transmit truncated or zero-length application payloads while the TCP connection otherwise appears healthy. This issue is fixed in version 7.23.