CVE-2026-73260

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-73260
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73260.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-73260
Aliases
  • GHSA-f6wr-mg35-p25g
Downstream
Published
2026-10-14T18:25:00Z
Modified
2026-10-16T07:11:26Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser
Details

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MG_TLS_BUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mg_der_to_tlv() and mg_der_next(), a peer-controlled length can advance the parser beyond the certificate and underflow the remaining uint32_t length, causing mg_tls_parse_cert_der() to continue walking an invalid pointer. An unauthenticated malicious TLS server, or a client presenting a certificate to a server configured for client certificates, can trigger an out-of-bounds read and denial of service during the handshake. This issue is fixed in version 7.23.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-125"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73260.json"
}
References

Affected packages

Git / github.com/cesanta/mongoose

Affected ranges

Type
GIT
Repo
https://github.com/cesanta/mongoose
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a8b4ae95db3c2db85e5ad9db3fefaeebb5f7b43e
Fixed
02bdbb9ed6f0a8f7c42228c6e7cb35d748b60551
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "7.23"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

3.*
3.2
3.3
3.4
3.5
3.6
3.7
3.8
4.*
4.0
4.1
5.*
5.0
5.1
5.2
5.3
5.4
5.5
5.5_20140120
5.6
6.*
6.0
6.1
6.10
6.11
6.12
6.13
6.14
6.15
6.16
6.17
6.18
6.2
6.3
6.4
6.5
6.6
6.7
6.9
7.*
7.0
7.1
7.11
7.12
7.13
7.14
7.15
7.16
7.17
7.18
7.19
7.2
7.20
7.21
7.22
7.3
7.4
7.5
7.6
7.7
7.8

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73260.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "213981136096248640611978943396017267651",
            "length":  610
        },
        "id":  "CVE-2026-73260-85d8c789",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/cesanta/mongoose/commit/a8b4ae95db3c2db85e5ad9db3fefaeebb5f7b43e",
        "target":  {
            "file":  "src/tls_builtin.c",
            "function":  "mg_der_to_tlv"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "213981136096248640611978943396017267651",
            "length":  610
        },
        "id":  "CVE-2026-73260-95387f1c",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/cesanta/mongoose/commit/a8b4ae95db3c2db85e5ad9db3fefaeebb5f7b43e",
        "target":  {
            "file":  "mongoose.c",
            "function":  "mg_der_to_tlv"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "124394138259036225932629568363532647872",
                "139709116596322563198480498833780995953",
                "235360255883762955674233621175853353169",
                "219936648244869027638078566151295136364",
                "185077388558120852012544171801399809806",
                "201273668825858706536625492116261927482",
                "89306668249278182338547637447717928084",
                "3870691890504760664170096862531715510",
                "188729046174796049320278951550318021462",
                "119695758224611338394967068421408468121",
                "237204443698544197507511548931600360954",
                "76845400444335940921878909852528792920",
                "220767147040442188183983019327440131905"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73260-a95e205c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/cesanta/mongoose/commit/a8b4ae95db3c2db85e5ad9db3fefaeebb5f7b43e",
        "target":  {
            "file":  "src/tls_builtin.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "124394138259036225932629568363532647872",
                "139709116596322563198480498833780995953",
                "235360255883762955674233621175853353169",
                "219936648244869027638078566151295136364",
                "185077388558120852012544171801399809806",
                "201273668825858706536625492116261927482",
                "89306668249278182338547637447717928084",
                "3870691890504760664170096862531715510",
                "188729046174796049320278951550318021462",
                "119695758224611338394967068421408468121",
                "237204443698544197507511548931600360954",
                "76845400444335940921878909852528792920",
                "220767147040442188183983019327440131905"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-73260-d38af171",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/cesanta/mongoose/commit/a8b4ae95db3c2db85e5ad9db3fefaeebb5f7b43e",
        "target":  {
            "file":  "mongoose.c"
        }
    }
]
vanir_signatures_modified 
"2026-10-16T07:11:26Z"