Description

Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_http_parse() and http_cb() paths in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy can use a different request boundary. This CL.TE desynchronization can inject requests that access or modify resources in another user context. This issue is fixed in version 7.22.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-20T18:16:46.973Z",
  "pubdate": "2026-08-20T18:16:46.973Z",
  "executiveSummary": "A CL.TE (Content-Length and Transfer-Encoding) request desynchronization vulnerability exists in the Mongoose embedded web server and network library prior to version 7.22.\nThe flaw allows remote, unauthenticated attackers to exploit discrepancies in HTTP header parsing between Mongoose and front-end reverse proxies.\nBy issuing specially crafted HTTP requests containing both Content-Length and Transfer-Encoding: chunked headers, an attacker can cause HTTP request smuggling.\nThis impacts the integrity and confidentiality of the application, potentially allowing unauthorized access to, or modification of, resources within another user context.\nExploitation requires network access to the target service through a misaligned reverse proxy infrastructure, permitting unauthenticated remote attackers to poison request queues.",
  "technicalDetails": "The vulnerability resides in the HTTP parsing logic implemented within the mg_http_parse() function and http_cb() callback paths located in src/http.c of the Mongoose embedded web server and network library.\nThe root cause is the improper validation and handling of conflicting HTTP framing headers, specifically accepting both Content-Length and Transfer-Encoding: chunked headers simultaneously within incoming HTTP requests.\nMongoose prioritizes chunked encoding when evaluating these headers, whereas a front-end reverse proxy positioned upstream may prioritize the Content-Length header.\nThis divergence in parsing behavior leads to HTTP request desynchronization, commonly referred to as CL.TE request smuggling.\nThe attack flow proceeds as follows: an unauthenticated remote attacker transmits a single HTTP request where the front-end proxy determines the message boundary using the Content-Length header, while the back-end Mongoose instance determines the boundary using the Transfer-Encoding: chunked header.\nBecause the proxy forwards the raw stream differently than how Mongoose parses it, the remaining bytes of the payload are interpreted by Mongoose as the beginning of a second, smuggled request.\nNetwork exposure is remote, and the attack requires zero authentication or elevated privileges, relying entirely on the structural discrepancy between the proxy and the embedded web server.\nPost-exploitation impact includes unauthorized resource access, request hijacking, cache poisoning, and the ability to execute actions in the context of subsequent users interacting with the server."
}