{"metadata": {"vulnerability": "CVE-2026-73260", "count": 12, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 7}}, "data": [{"timestamp": "2026-08-11T17:18:01.598Z", "date_only": false, "value": "2026-08-11T17:18:01.598Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-73260", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-14T00:00:00Z", "date_only": false, "value": "2026-08-14T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-73260", "record": "UBUNTU-CVE-2026-73260", "field": "published"}, {"timestamp": "2026-08-14T00:00:00Z", "date_only": false, "value": "2026-08-14T00:00:00Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-73260", "record": "UBUNTU-CVE-2026-73260", "field": "modified"}, {"timestamp": "2026-10-14T18:25:00.518Z", "date_only": false, "value": "2026-10-14T18:25:00.518Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-73260", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T18:25:00.518Z", "date_only": false, "value": "2026-10-14T18:25:00.518Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-73260", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T19:17:19.840Z", "date_only": false, "value": "2026-10-14T19:17:19.840", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-73260", "record": "FKIE_CVE-2026-73260", "field": "published"}, {"timestamp": "2026-10-14T23:43:11.610Z", "date_only": false, "value": "2026-10-14T23:43:11.610340Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117441913888564793", "record": "CVE-2026-73260", "field": "creation_timestamp", "uuid": "ff4a5e82-d7f1-411b-aa45-2a5cfea52173", "content": "CVE-2026-73260 Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MG_TLS_BUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mg_der_to_tlv() and mg_der_next(), a peer-controlled length can advance the parser beyond the certificate and underflow the remaining uint32_t length, causing mg_tls_parse_cert_der() to continue walking an invalid pointer. An unauthenticated malicious TLS server, or a client presenting a certificate to a server configured for client certificates, can trigger an out-of-bounds read and denial of service during the handshake. This issue is fixed in version 7.23.\nhttps://www.cve.org/CVERecord?id=CVE-2026-73260https://github.com/cesanta/mongoose/security/advisories/GHSA-f6wr-mg35-p25ghttps://github.com/cesanta/mongoose/commit/a8b4ae95db3c2db85e5ad9db3fefaeebb5f7b43ehttps://github.com/cesanta/mongoose/releases/tag/7.23#cesanta #mongoose#CVE_2026_73260#bot", "url": "https://infosec.exchange/users/cve/statuses/117441913888564793"}, {"timestamp": "2026-10-20T01:49:51.017Z", "date_only": false, "value": "2026-10-20T01:49:51.017897Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-73260", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-20T01:49:51.017Z", "date_only": false, "value": "2026-10-20T01:49:51.017897Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-73260", "record": "FKIE_CVE-2026-73260", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-20T01:50:00.898Z", "date_only": false, "value": "2026-10-20T01:50:00.898Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-73260", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-20T01:50:00.898Z", "date_only": false, "value": "2026-10-20T01:50:00.898Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-73260", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-20T02:17:11.720Z", "date_only": false, "value": "2026-10-20T02:17:11.720", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-73260", "record": "FKIE_CVE-2026-73260", "field": "lastModified"}]}