Description

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mg_http_next_multipart() in src/http.c. The loops comparing s[b] and s[b + 1], and s[h2] and s[h2 + 1], use an incorrect AND condition and stop when either character resembles part of a CRLF terminator. This truncates headers, filenames, or boundaries and can cause an application to accept dangerous content after seeing a misleading Content-Type value. This issue is fixed in version 7.22.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-20T18:16:47.323Z",
  "pubdate": "2026-08-20T18:16:47.323Z",
  "executiveSummary": "Mongoose embedded web server and network library prior to version 7.22 contains a critical vulnerability involving improper validation of multipart input data.\nThe flaw stems from logic errors within multipart boundary and header parsing functions, specifically utilizing incorrect conditional operations when evaluating carriage return and line feed characters.\nA remote, unauthenticated attacker can exploit this weakness by supplying malformed multipart payloads containing isolated carriage returns or line feeds.\nSuccessful exploitation results in the truncation of HTTP headers, filenames, or body boundaries, allowing malicious payloads to bypass security filters due to misleading Content-Type values.\nThis vulnerability compromises the integrity of file uploads and request parsing in embedded applications, potentially leading to the acceptance and processing of dangerous content.\nRemediation requires upgrading the Mongoose library to version 7.22 or later, where the input boundary checking logic has been properly corrected.",
  "technicalDetails": "The vulnerability resides in the mg_http_next_multipart() function located within src/http.c of the Mongoose embedded web server and network library, affecting all versions prior to 7.22.\nThe root cause of the vulnerability is the implementation of an incorrect logical AND condition within iteration loops responsible for parsing and validating MIME multipart boundaries and associated headers.\nSpecifically, the comparison loops evaluating adjacent buffer indexes—such as s[b] versus s[b + 1] and s[h2] versus s[h2 + 1]—erroneously terminate execution when either individual character matches a component of a CRLF terminator, rather than requiring the complete sequence.\nThis flawed boundary detection logic causes premature termination during parsing, resulting in the truncation of critical HTTP header fields, embedded filenames, or multipart boundary markers.\nAn external remote attacker can leverage network exposure to submit specially crafted multipart HTTP requests to the embedded web server without requiring authentication or elevated privileges.\nBy injecting a lone carriage return (CR) or line feed (LF) character into the multipart stream, the attacker manipulates the parser into falsely identifying the end of a header or boundary section.\nThis parser truncation misleads the receiving application regarding the true boundaries of the data stream and the associated Content-Type values, facilitating the smuggling or acceptance of dangerous and unvalidated content.\nSubsequent application logic processes the truncated payload under false assumptions, which can undermine application-layer security boundaries and file validation routines."
}