CVE-2026-73252

Executive Summary

CVE-2026-73252 is a heap out-of-bounds read vulnerability in Mongoose, an embedded web server and network library, affecting versions prior to 7.23 when the built-in TLS stack (selected via MG_TLS_BUILTIN) is compiled in. An unauthenticated remote TLS peer can send a malformed TLS 1.3 record that causes an integer underflow in receive-length calculation, leading to a heap out-of-bounds read before certificate or Finished validation. The primary impact is remote denial of service; no public proof-of-concept or active exploitation has been observed as of this writing.

Technical Analysis

The vulnerability resides in the built-in TLS stack selected by the MG_TLS_BUILTIN compile-time option, specifically in src/tls_builtin.c. Within mg_tls_recv_record(), the implementation accepts a TLS 1.3 record whose decrypted size equals exactly the 16-byte authentication tag, containing no plaintext and no ContentType byte. The msgsz length check permits this degenerate record to pass validation. Because the record carries an authentication tag but no payload, a subsequent receive-length (recv_len) calculation underflows to SIZE_MAX. This underflow corrupts the length bookkeeping such that a later handshake step interprets stale buffer contents as a trusted message with an effectively unbounded length.

The result is a heap out-of-bounds read that occurs before certificate validation or the Finished message check. Consequently, no authentication, certificate trust, or handshake completion is required — any peer that can complete enough of the TLS 1.3 record framing to deliver the malformed record can reach the flawed code path. The root cause maps to CWE-125 (Out-of-Bounds Read), compounded by an integer-underflow condition in length arithmetic. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H reflects a network-reachable, low-complexity, unauthenticated trigger with high availability impact and no confidentiality or integrity impact — consistent with a crash/denial-of-service outcome rather than memory disclosure designed for exfiltration.

Because the failure is a read (not a write) primitive and occurs pre-authentication, the practical consequence is process instability or termination — a remote DoS. No evidence in the available data indicates reliable write primitives, controlled disclosure, or code execution. The description is sufficiently detailed to identify the class and mechanism but does not enumerate additional call sites, buffer sizes, or allocation structures beyond mg_tls_recv_record() and the msgsz/recv_len computation.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class and the NVD description.

1. Reconnaissance/target identification: An attacker identifies network-exposed services built on Mongoose with the built-in TLS stack enabled (MG_TLS_BUILTIN) and running a version prior to 7.23. Service fingerprinting (TLS handshake behavior, HTTP headers on Mongoose-based embedded interfaces) supports target selection.

2. Triggering the specific flaw: The attacker initiates a TLS 1.3 connection and crafts a record whose decrypted size is exactly the 16-byte authentication tag, with no plaintext and no ContentType byte. This record is delivered during the handshake, before certificate or Finished validation, reaching mg_tls_recv_record().

3. Payload/execution method at the vulnerability-class level: The malformed record satisfies the msgsz length check, causing the recv_len calculation to underflow to SIZE_MAX. No crafted shellcode or write payload is required — the trigger is the record structure itself. A subsequent handshake step then treats stale buffer contents as a trusted message with an effectively unbounded length, producing a heap out-of-bounds read.

4. Post-exploitation impact: The out-of-bounds read causes a remote denial of service (process crash or unstable memory access). No authentication is needed (PR:N). There is no described path to confidentiality or integrity impact, so lateral movement or data exfiltration is not supported by the available evidence.

Impact Assessment

Successful exploitation yields a remote denial of service against services embedding the affected Mongoose TLS stack. With CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), the attack is network-reachable, low-complexity, and requires no privileges or user interaction. Availability impact is High; confidentiality and integrity impacts are None, and scope is Unchanged — the flaw degrades the vulnerable component itself rather than crossing a trust boundary. Affected systems are embedded web servers, IoT/edge appliances, and network libraries that: (a) compile Mongoose with MG_TLS_BUILTIN, and (b) run versions prior to 7.23. Blast radius is bounded by the number of such exposed endpoints; repeatable, unauthenticated triggering means any single malformed TLS peer can deny service. No CISA KEV listing, no EPSS score, and no public exploit or Nuclei template currently exist, so near-term risk is driven by exposure and the breadth of embedded deployments rather than active exploitation.

Detection Guidance

Sigma Rule

title: Mongoose TLS Builtin Malformed TLS 1.3 Record DoS Attempt (CVE-2026-73252)
id: 9f2c1a4e-7325-4b1a-9c0d-2026cve73252
status: experimental
description: Detects potential exploitation of CVE-2026-73252 via malformed TLS 1.3 records targeting Mongoose built-in TLS stack
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73252
author: valtersit.com
date: 2026/01/01
logsource:
  category: application
  product: mongoose
detection:
  selection:
    EventID:
      - 'TLS_RECORD_ERROR'
      - 'TLS_HANDSHAKE_ERROR'
    Message|contains:
      - 'tls_recv_record'
      - 'recv_len'
      - 'msgsz'
  condition: selection
falsepositives:
  - Legitimate malformed TLS clients
  - Fuzzing activity
level: medium
tags:
  - attack.t1190
  - cve.2026.73252

YARA Rule

rule CVE_2026_73252_Mongoose_TLS_OOB_Read
{
    meta:
        description = "Detects Mongoose built-in TLS stack vulnerable receive logic (CVE-2026-73252)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73252"
        cve = "CVE-2026-73252"
    strings:
        $s1 = "mg_tls_recv_record" ascii
        $s2 = "MG_TLS_BUILTIN" ascii
        $s3 = "recv_len" ascii
    condition:
        uint16(0) == 0x5a4d or any of ($s*) and filesize < 5MB
}

Suricata IDS Rule

alert tls any any -> any any (msg:"CVE-2026-73252 Mongoose Built-in TLS Malformed TLS1.3 Record OOB Read DoS Attempt"; flow:established,to_server; tls.version:1.3; dsize:16; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-dos; reference:cve,2026-73252; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73252; sid:202673252; rev:1;)

Elastic Detection

process where event.action == "network_connection" and
  network.transport == "tcp" and
  tls.version == "1.3" and
  network.bytes <= 16

Splunk SPL Query

index=network sourcetype=firewall OR sourcetype=suricata
| search "CVE-2026-73252" OR "mongoose" OR "tls_builtin"
| stats count min(_time) as firstTime max(_time) as lastTime by src_ip dest_ip dest_port
| where count >= 3
| convert ctime(firstTime) ctime(lastTime)

Wazuh OSSEC Rule

<group name="mongoose,cve-2026-73252,">
  <rule id="202673252" level="10">
    <decoded_as>json</decoded_as>
    <field name="event_type">tls_handshake_error</field>
    <field name="tls_version">1.3</field>
    <description>CVE-2026-73252: Possible Mongoose built-in TLS malformed record DoS attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor-supplied fix, workaround, or affected-version list is currently available from tracked sources; the upstream description states the issue is fixed in Mongoose 7.23.

1. Immediate mitigations:

   • Upgrade Mongoose to version 7.23 or later where the fixed receive-length handling is present per the upstream description.
   • Where immediate upgrade is not possible, avoid compiling with MG_TLS_BUILTIN; use an alternate TLS backend if the deployment permits.
   • Restrict network exposure of Mongoose-based services (firewall/ACL) so only trusted peers can initiate TLS handshakes.
   • Monitor for repeated TLS handshake failures and process crashes as a signal of attempted triggers.

2. Patch/upgrade steps:

   • Track the upstream Mongoose source (src/tls_builtin.c, mg_tls_recv_record()) for the fix in 7.23.
   • Rebuild and redeploy affected embedded components with the updated library; validate TLS 1.3 handshakes post-upgrade.
   • Since no patch evidence exists in tracked sources, verify the fix by reviewing the changelog and diff after a release is published.

3. Long-term hardening:

   • Enforce strict TLS record-length validation and guard against integer underflow in receive-length calculations in any in-house TLS handling.
   • Fuzz test the TLS record receive path with degenerate records (tag-only, zero-length plaintext) as part of CI.
   • Maintain an SBOM to rapidly identify embedded deployments using Mongoose's built-in TLS stack.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73252
• Mongoose project source (src/tls_builtin.c, mg_tls_recv_record)
• CWE-125: Out-of-Bounds Read — https://cwe.mitre.org/data/definitions/125.html
• CISA KEV Catalog (CVE not listed as of this writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (not yet scored): https://www.first.org/epss/