CVE-2026-115473
Mongoose is an embedded web server and network library. Prior to 7.22, mg_path_is_sane in src/util.c read path.buf[1] without first requiring path.len to be at least two and read s[2] when only two bytes remained. Unauthenticated remote requests reaching mg_http_upload or mg_http_serve_dir with the affected short path shapes could therefore trigger one-byte heap out-of-bounds reads. On bare-metal or RTOS targets without memory protection, the adjacent byte could be exposed or influence whether a path was accepted, and instrumented builds could crash. This issue is fixed in version 7.22.
- Score
- 6.5 medium
- Published
- 2026-11-04
- Links
- NVD · cve.org · Report wrong data
Matched ports (1)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| www/mongoose | mongoose | 5.6_1 | unaddressed | lytboris@gmail.com |
Template for a VuXML entry
Check the version numbers before you commit this entry. Some ports share an entry in the CVE database with another port, such as sqlite2 and sqlite3. The version shown here may then be one that never existed for this port.
Ranges per package from the CVE rows that match this port, in pkg notation with the port's epoch and revision, every bound checked with pkg; one range per epoch the port actually had. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>mongoose -- FIXME</topic>
<affects>
<package>
<name>mongoose</name>
<range><lt>7.22</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE-2026-115473: Mongoose is an embedded web server and network
library. Prior to 7.22, mg_path_is_sane in src/util.c read
path.buf[1] without first requiring path.len to be at least two and
read s[2] when only two bytes remained. Unauthenticated remote
requests reaching mg_http_upload or mg_http_serve_dir with the
affected short path shapes could therefore trigger one-byte heap
out-of-bounds reads. On bare-metal or RTOS targets without memory
protection, the adjacent byte could be exposed or influence whether
a path was accepted, and instrumented builds could crash. This
issue is fixed in version 7.22.</p>
</body>
</description>
<references>
<cvename>CVE-2026-115473</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2026-115473</url>
</references>
<dates>
<discovery>2026-11-04</discovery>
<entry>2026-11-05</entry>
</dates>
</vuln>