CVE-2026-73260

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73260
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73260.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73260
Aliases
  • GHSA-f6wr-mg35-p25g
Downstream
Published
2026-10-14T18:25:00Z
Modified
2026-10-28T11:23:03Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser
Details

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MG_TLS_BUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mg_der_to_tlv() and mg_der_next(), a peer-controlled length can advance the parser beyond the certificate and underflow the remaining uint32_t length, causing mg_tls_parse_cert_der() to continue walking an invalid pointer. An unauthenticated malicious TLS server, or a client presenting a certificate to a server configured for client certificates, can trigger an out-of-bounds read and denial of service during the handshake. This issue is fixed in version 7.23.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73260.json"
}
References

Affected packages

Git / github.com/cesanta/mongoose

Affected ranges

Type
GIT
Repo
https://github.com/cesanta/mongoose
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
02bdbb9ed6f0a8f7c42228c6e7cb35d748b60551
Fixed
a8b4ae95db3c2db85e5ad9db3fefaeebb5f7b43e
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "7.23"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "a8b4ae95db3c2db85e5ad9db3fefaeebb5f7b43e"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "7.23",
            "range": [
                {
                    "fixed": "02bdbb9ed6f0a8f7c42228c6e7cb35d748b60551"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

3.*
3.2
3.3
3.4
3.5
3.6
3.7
3.8
4.*
4.0
4.1
5.*
5.0
5.1
5.2
5.3
5.4
5.5
5.5_20140120
5.6
6.*
6.0
6.1
6.10
6.11
6.12
6.13
6.14
6.15
6.16
6.17
6.18
6.2
6.3
6.4
6.5
6.6
6.7
6.9
7.*
7.0
7.1
7.11
7.12
7.13
7.14
7.15
7.16
7.17
7.18
7.19
7.2
7.20
7.21
7.22
7.3
7.4
7.5
7.6
7.7
7.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73260.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "213981136096248640611978943396017267651",
            "length": 610
        },
        "id": "CVE-2026-73260-85d8c789",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/cesanta/mongoose/commit/a8b4ae95db3c2db85e5ad9db3fefaeebb5f7b43e",
        "target": {
            "file": "src/tls_builtin.c",
            "function": "mg_der_to_tlv"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "213981136096248640611978943396017267651",
            "length": 610
        },
        "id": "CVE-2026-73260-95387f1c",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/cesanta/mongoose/commit/a8b4ae95db3c2db85e5ad9db3fefaeebb5f7b43e",
        "target": {
            "file": "mongoose.c",
            "function": "mg_der_to_tlv"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "124394138259036225932629568363532647872",
                "139709116596322563198480498833780995953",
                "235360255883762955674233621175853353169",
                "219936648244869027638078566151295136364",
                "185077388558120852012544171801399809806",
                "201273668825858706536625492116261927482",
                "89306668249278182338547637447717928084",
                "3870691890504760664170096862531715510",
                "188729046174796049320278951550318021462",
                "119695758224611338394967068421408468121",
                "237204443698544197507511548931600360954",
                "76845400444335940921878909852528792920",
                "220767147040442188183983019327440131905"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-73260-a95e205c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/cesanta/mongoose/commit/a8b4ae95db3c2db85e5ad9db3fefaeebb5f7b43e",
        "target": {
            "file": "src/tls_builtin.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "124394138259036225932629568363532647872",
                "139709116596322563198480498833780995953",
                "235360255883762955674233621175853353169",
                "219936648244869027638078566151295136364",
                "185077388558120852012544171801399809806",
                "201273668825858706536625492116261927482",
                "89306668249278182338547637447717928084",
                "3870691890504760664170096862531715510",
                "188729046174796049320278951550318021462",
                "119695758224611338394967068421408468121",
                "237204443698544197507511548931600360954",
                "76845400444335940921878909852528792920",
                "220767147040442188183983019327440131905"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-73260-d38af171",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/cesanta/mongoose/commit/a8b4ae95db3c2db85e5ad9db3fefaeebb5f7b43e",
        "target": {
            "file": "mongoose.c"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:23:03Z"