{"vulnerability": "CVE-2026-73252", "sightings": [{"uuid": "49d25399-3783-4576-a292-96ab84a867d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-73252", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117441911241613749", "content": "CVE-2026-73252 Mongoose: Unauthenticated remote heap out-of-bounds read in built-in TLS: off-by-one length check in mg_tls_recv_record() underflows recv_len to SIZE_MAX Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MG_TLS_BUILTIN in src/tls_builtin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no plaintext or ContentType byte. In mg_tls_recv_record(), the msgsz length check permits that record and the recv_len calculation underflows to SIZE_MAX, so a later handshake step treats stale buffer contents as a trusted message with an effectively unbounded length. An unauthenticated malicious TLS peer can trigger a heap out-of-bounds read before certificate or Finished validation, causing a remote denial of service. This issue is fixed in version 7.23.\nhttps://www.cve.org/CVERecord?id=CVE-2026-73252https://github.com/cesanta/mongoose/security/advisories/GHSA-hq58-98f5-2wg3https://github.com/cesanta/mongoose/commit/758e301f0c9a9885c1b716195df5fe6d6ac9d53ehttps://github.com/cesanta/mongoose/releases/tag/7.23#cesanta #mongoose#CVE_2026_73252#bot", "creation_timestamp": "2026-10-14T23:42:31.247220Z"}]}