{"schema":"threatline.record/2","record":{"id":"CVE-2026-73261","aliases":["GHSA-3fmr-92g4-wchx"],"summary":"Mongoose: handle_opt() missing opts[1] > len check — 1-byte OOB read corrupts TCP MSS, silences mg_send() per connection","details":"Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP in src/net_builtin.c does not reject a TCP option whose declared opts[1] length exceeds the remaining option bytes. In handle_opt(), a NOP followed by a truncated MSS option causes opts[3] to be read outside the declared options area and used as the low byte of dmss. An unauthenticated remote peer can corrupt the per-connection MSS value so later mg_send() calls transmit truncated or zero-length application payloads while the TCP connection otherwise appears healthy. This issue is fixed in version 7.23.","categories":["Unclassified"],"product":"mongoose","vendor":"cesanta","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-73261","source_modified_at":"2026-10-14T18:25:41.102Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"mongoose","vendor":"cesanta","versions":[{"version":"< 7.23","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00349,"percentile":0.27382,"score_date":"2026-10-23"},"published_at":"2026-10-14T18:25:41.102Z","modified_at":"2026-10-14T18:25:41.102Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-73261","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-14T18:25:41.102Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-73261","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/cesanta/mongoose/security/advisories/GHSA-3fmr-92g4-wchx","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/cesanta/mongoose/commit/cc7c6d2d18c28fcc6d085633dddd88402946140a","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/cesanta/mongoose/releases/tag/7.23","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-14T18:25:41.102Z","content_hash":"be2caf324f2fd23ce8ec8a8b660ed33b6293b516e3344588b04dd159e7eb4fa0"}}