Description

Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http_cb() function in src/http.c tests hm.proto.len with an impossible greater-than-eight condition even though mg_http_parse() requires an eight-byte protocol string, so is_http_1_0 is never set. Mongoose consequently processes chunked encoding that an HTTP/1.0 proxy can ignore, enabling request smuggling and unauthorized access or state changes. This issue is fixed in version 7.22.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-20T18:16:46.523Z",
  "pubdate": "2026-08-20T18:16:46.523Z",
  "executiveSummary": "An HTTP request smuggling vulnerability exists in Mongoose prior to version 7.22 when deployed in an HTTP/1.0 reverse-proxy configuration. The vulnerability arises from improper parsing and validation of protocol versions and header framing mechanisms within the embedded web server and network library.\nA remote, unauthenticated attacker can exploit this flaw by sending a specially crafted HTTP request containing a Transfer-Encoding: chunked header alongside conflicting framing directives. Because the affected deployment processes chunked encoding that an upstream HTTP/1.0 proxy typically ignores or misinterprets, attackers can successfully smuggle downstream requests.\nThe primary impact includes unauthorized access to restricted endpoints and unintended state changes on the target system. This compromises the integrity and confidentiality of the application tier behind the reverse-proxy. Exploitation requires network access to the target via the vulnerable reverse-proxy setup, with no prior authentication or elevated privileges required.",
  "technicalDetails": "The root cause of the vulnerability resides in the http_cb() function located within the src/http.c source file. During the parsing lifecycle, the function validates the protocol length field (hm.proto.len) using an impossible greater-than-eight condition. However, the preceding mg_http_parse() function strictly mandates an eight-byte protocol string requirement. Consequently, this flawed conditional check ensures that the internal tracking flag is_http_1_0 is never successfully set.\nIn an HTTP/1.0 reverse-proxy deployment, this parsing failure causes the backend Mongoose instance to misinterpret message boundaries when presented with conflicting framing mechanisms. Specifically, an attacker injects a request utilizing Transfer-Encoding: chunked combined with legacy or alternate framing indicators. The front-end proxy, operating under HTTP/1.0 assumptions, handles or ignores the headers differently than the backend Mongoose server.\nThe step-by-step attack flow proceeds as follows: First, the remote unauthenticated attacker crafts a malicious HTTP request embedding chunked transfer encoding data alongside ambiguous length or framing headers. Second, the attacker transmits this payload through the network to the HTTP/1.0 reverse-proxy. Third, the proxy forwards the stream to the Mongoose backend, where the vulnerable http_cb() function fails to evaluate the protocol version correctly due to the faulty length condition. Fourth, Mongoose processes the chunked encoding payload while the proxy interprets the boundaries differently, causing a desynchronization in request parsing. Finally, the trailing bytes of the smuggled payload are interpreted by Mongoose as a distinct, subsequent request, allowing the attacker to bypass proxy-level access controls and execute unauthorized operations."
}