CVE-2026-73252: Mongoose Embedded Library Built-in TLS Pre-Auth Heap Out-of-Bounds Read (pending)

CVE-2026-73252 is an integer-underflow / out-of-bounds-read flaw (CWE-191, CWE-125) in the built-in TLS stack of Cesanta's Mongoose embedded web server and network library: a malicious TLS peer can send a 16-byte TLS 1.3 record that passes Mongoose's length check but causes an internal length variable to underflow to SIZE_MAX, after which Mongoose reads stale buffer bytes as an unbounded trusted message before certificate or Finished validation — an unauthenticated, pre-authentication denial-of-service primitive; NVD has not, as of 2026-11-07, published its own CVSS score.

CVE-2026-73252 (CWE-125 out-of-bounds read, CWE-191 integer underflow) affects Mongoose, Cesanta's single-file embedded web server and TCP/IP/TLS networking library widely compiled directly into device firmware (it is distributed as mongoose.c/mongoose.h for microcontrollers and embedded Linux). NVD's description states: "Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MG_TLS_BUILTIN in src/tls_builtin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no plaintext or ContentType byte. In mg_tls_recv_record(), the msgsz length check permits that record and the recv_len calculation underflows to SIZE_MAX, so a later handshake step treats stale buffer contents as a trusted message with an effectively unbounded length. An unauthenticated malicious TLS peer can trigger a heap out-of-bounds read before certificate or Finished validation, causing a remote denial of service. This issue is fixed in version 7.23" (NVD).

NVD tracks CVE-2026-73252 with status "Deferred": it records only a GitHub Security Advisory-submitted score (source [email protected]) — CVSS v3.1 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H — typed Secondary, not NVD's own Primary rating, so this page does not show a headline severity score rather than presenting that figure as NVD-confirmed (NVD).

Cesanta's own GitHub Security Advisory GHSA-hq58-98f5-2wg3, published 2026-08-12 and rated "High" severity by the maintainers, gives the technical root cause: the length guard in mg_tls_recv_record() only rejects msgsz < 16, but a valid TLS 1.3 ciphertext must be at least 17 bytes (16-byte tag plus 1 ContentType byte); when msgsz == 16, the computation tls->recv_len = (size_t)msgsz - 16 - 1 underflows to SIZE_MAX, a value that persists across calls so the next read short-circuits on a leftover-data check and processes stale buffer bytes as a fully-decrypted, trusted message — reachable pre-authentication by any TLS peer connecting to a Mongoose-based TLS server or client (Mongoose GHSA-hq58-98f5-2wg3). The advisory lists affected versions as all releases up to and including 7.22, patched in 7.23, and the fix landed in commit 758e301f0c9a9885c1b716195df5fe6d6ac9d53e (Mongoose commit, Mongoose 7.23 release).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.00376 (31.777th percentile) as of 2026-11-06 (CISA KEV, FIRST EPSS).

NVD has not finished its own severity analysis. In the meantime, firmware and devices that embed Mongoose with MG_TLS_BUILTIN for either TLS server or client roles should be rebuilt against Mongoose 7.23 or later; the only way to confirm exposure is to check the Mongoose version compiled into the firmware image, since this is a source-embedded library rather than a shared system package.

• A TLS 1.3 record whose decrypted size is exactly 16 bytes causes an integer underflow in mg_tls_recv_record(), letting an unauthenticated TLS peer trigger a pre-authentication heap out-of-bounds read / denial of service in Mongoose's built-in TLS stack; fixed in 7.23. — NVD
• NVD status is "Deferred" with a GitHub Security Advisory-submitted Secondary CVSS v3.1 7.5 (high); no NVD-published Primary score. — NVD
• Cesanta's GHSA-hq58-98f5-2wg3 (published 2026-08-12, rated High) explains the length-guard off-by-one in mg_tls_recv_record(), confirms affected versions up to 7.22 patched in 7.23, and the fix commit. — Mongoose GHSA-hq58-98f5-2wg3
• The fix commit 758e301f0c9a9885c1b716195df5fe6d6ac9d53e is included in the Mongoose 7.23 release. — Mongoose 7.23 release
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.00376 (31.777th percentile) as of 2026-11-06. — FIRST EPSS