CVE-2026-115473

Mongoose is an embedded web server and network library. Prior to 7.22, mg_path_is_sane in src/util.c read path.buf[1] without first requiring path.len to be at least two and read s[2] when only two bytes remained. Unauthenticated remote requests reaching mg_http_upload or mg_http_serve_dir with the affected short path shapes could therefore trigger one-byte heap out-of-bounds reads. On bare-metal or RTOS targets without memory protection, the adjacent byte could be exposed or influence whether a path was accepted, and instrumented builds could crash. This issue is fixed in version 7.22.

• CWE-125
• CWE-158

• https://github.com/cesanta/mongoose/commit/b55de8b151d1466a3e41d1f854f22eeb6faa23dc
• https://github.com/cesanta/mongoose/releases/tag/7.22
• https://github.com/cesanta/mongoose/security/advisories/GHSA-cjmx-764f-286c
• https://github.com/cesanta/mongoose/security/advisories/GHSA-cjmx-764f-286c

Published

Nov 4, 2026

Last Modified

Nov 5, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-115453Authorization Bypass Through User-Controlled Key (CWE-639) i…7.1
• CVE-2026-115454An excessive resource allocation issue in the remote workflo…5.3
• CVE-2026-115455A flaw was found in GCC libstdc++. When an application extra…6.5
• CVE-2026-115456A flaw was found in gcc. An attacker could cause a Denial of…3.7
• CVE-2026-115457baserCMS is a website development framework. In versions 5.0…7.1
• CVE-2026-11546IBM WebSphere Application Server - Liberty 17.0.0.3 through …9.8
• CVE-2026-115474Zulip is an open-source team collaboration tool. From 8.0 un…6.5
• CVE-2026-115477obsidian-tc is a governed, agent-ready Model Context Protoco…7.1
• CVE-2026-115478obsidian-tc is a governed, agent-ready Model Context Protoco…7.1
• CVE-2026-115479baserCMS is a website development framework. In versions 5.2…5.3
• CVE-2026-11548IBM WebSphere Application Server 8.5 and 9.0, and and IBM We…4.8
• CVE-2026-115480baserCMS is a website development framework. In versions 5.0…5.3