DEBIAN-CVE-2026-115473

    Dashboard / Vulnerabilities / DEBIAN-CVE-2026-115473

    DEBIAN-CVE-2026-115473

    Published: 4 Nov 2026Last Modified: 7 Nov 2026
    Upstream:
    CVE-2026-115473

    Summary:

    Details: Mongoose is an embedded web server and network library. Prior to 7.22, mg_path_is_sane in src/util.c read path.buf[1] without first requiring path.len to be at least two and read s[2] when only two bytes remained. Unauthenticated remote requests reaching mg_http_upload or mg_http_serve_dir with the affected short path shapes could therefore trigger one-byte heap out-of-bounds reads. On bare-metal or RTOS targets without memory protection, the adjacent byte could be exposed or influence whether a path was accepted, and instrumented builds could crash. This issue is fixed in version 7.22.

    References: https://security-tracker.debian.org/tracker/CVE-2026-115473

    Affected packages

    Package

    Name: mongoose

    Purl: pkg:deb/debian/mongoose?arch=source&distro=forky

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -7.22+ds-1

    Affected versions

    7.21+ds-1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    DEBIAN-CVE-2026-115473 | CVE-DB