CVE-2026-73258

Executive Summary

CVE-2026-73258 is an input-parsing flaw in Mongoose, an embedded web server and network library, affecting all versions prior to 7.22. A remote, unauthenticated attacker can craft multipart HTTP requests containing lone carriage return (CR) or line feed (LF) characters that cause the mg_http_next_multipart() parser in src/http.c to prematurely terminate header, filename, or boundary parsing due to an incorrect AND condition in the comparison loops. This allows an attacker to truncate content-type declarations and potentially cause the application to accept and process dangerous content (e.g., uploaded file content) under an incorrect MIME-type classification. The CVSS v3.1 score is 6.5 (Medium severity), reflecting low confidentiality and integrity impact with no availability impact, and no prerequisites for exploitation (network-accessible, no authentication, no user interaction).

Technical Analysis

The vulnerability resides in the multipart parser function mg_http_next_multipart() in src/http.c — the exact file path is provided in the NVD description. Multipart parsing is used for handling multipart/form-data requests, commonly found in file upload functionality, web forms, and REST API endpoints that accept binary or mixed content.

According to the NVD description, the flaw is in two specific comparison loops within the parser:

1. A loop comparing s[b] and s[b + 1]
2. A loop comparing s[h2] and s[h2 + 1]

The description states these loops use an incorrect AND condition and stop when either character resembles part of a CRLF (\r\n) terminator. A correct implementation would use an OR condition — stopping only when the sequence \r\n is fully matched. Because the AND condition halts when only a single CR or LF character is present, a lone carriage return or line feed injected into the multipart body prematurely terminates the parsing loop.

The consequence is that header fields, filename attributes, and boundary strings are truncated. Critically, an attacker can truncate a Content-Type declaration so that the application observes a benign MIME type (e.g., text/plain) while the actual content following the CR/LF is something else entirely (e.g., an HTML file with embedded JavaScript, or a file that a downstream parser will treat as executable content). This is a confusion between parser state and content type, falling under CWE-697 (Incorrect Comparison).

The attack surface is any network-facing Mongoose instance (versions prior to 7.22) that parses multipart/form-data — which includes file upload endpoints, REST APIs, and embedded web UIs commonly found in IoT devices, routers, and other firmware appliances.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N confirms:

• Attack Vector: Network (remote)
• Attack Complexity: Low (no special conditions required)
• Privileges Required: None (unauthenticated)
• User Interaction: None
• Scope: Unchanged
• Impact: Low confidentiality, Low integrity, No availability

Exploitation Scenarios

Important caveat: No public PoC is available, and the NVD description contains limited implementation detail. The attack chain below is inferred from the vulnerability class (multipart header truncation) and the specific mechanism described (premature loop termination on lone CR/LF).

Step 1 — Reconnaissance / Target Identification: An attacker scans the internet (e.g., via Shodan using product:mongoose or server:"Mongoose") to identify exposed Mongoose instances. The attacker would then fingerprint the exact version — either via server headers, error pages, or by testing whether the target responds to multipart requests. Target selection favors publicly accessible web interfaces, IoT management consoles, or APIs that accept file uploads.

Step 2 — Triggering the Flaw: The attacker crafts a raw HTTP POST request with Content-Type: multipart/form-data; boundary=XYZ. In the body, the attacker places a lone carriage return or line feed in a strategic position — for instance, immediately after a filename declaration (filename="evil.html\r) or inside a part's Content-Type header. When mg_http_next_multipart() encounters this character, the faulty AND-condition loop stops, truncating the parsed field value.

Step 3 — Payload Execution (Vulnerability-Class Level): The attacker constructs a multipart body where the visible Content-Type declares a benign type (e.g., text/plain), but the CR/LF truncation causes the parser to accept the remainder of the content as a different type. Depending on how the downstream application uses the parsed filename/header values, this can lead to:

• Stored XSS / HTML injection: The application serves the uploaded file as text/html because the Content-Type was truncated or overwritten, enabling stored cross-site scripting when a victim views the uploaded content.
• Configuration/Injection: If the truncated filename is used in a shell command, path construction, or database query without proper sanitization, the attacker may achieve command injection, local file inclusion, or SQL injection, depending on the application context.
• WAF/Filter Bypass: Security filters that inspect the Content-Type header (e.g., "only allow images") can be bypassed because the filter sees one MIME type while the application processes another.

Step 4 — Post-Exploitation Impact: Post-exploitation outcomes vary with the application. In a web-upload context, the attacker could achieve persistent stored XSS (session hijacking, phishing, credential theft). In an IoT/firmware context, the attacker might upload firmware or configuration files that change device behavior. The low confidentiality/integrity CVSS impact suggests the likely outcome is content-type confusion leading to limited data exposure or integrity manipulation, not full remote code execution.

Note: No public PoC or exploit code is available as of this report. The precise exploitation success rate and the downstream application behavior cannot be independently verified without additional vendor documentation or a Proof-of-Concept.

Impact Assessment

Business Impact: Medium severity (CVSS 6.5). The vulnerability allows remote, unauthenticated attackers to manipulate how multipart content is interpreted. The primary business risks are:

• Data Integrity (Low): An attacker can cause the application to accept and store/process files under an incorrect MIME type, potentially leading to stored XSS on web-facing applications, or misclassification of uploaded content that feeds downstream processing pipelines.
• Confidentiality (Low): In scenarios where the truncated headers reveal server-side error messages or where XSS is used to exfiltrate data, there is limited confidentiality impact.
• Availability (None): The flaw does not crash the server or cause memory corruption.

Affected Systems: All Mongoose deployments prior to version 7.22 that expose multipart/form-data parsing to the network. This includes embedded devices (routers, cameras, IoT gateways), microcontrollers with web servers, and lightweight server applications. Given Mongoose's prevalence in IoT firmware, the attack surface is broad but device-specific exposures vary.

Blast Radius: The attack is network-reachable but requires a multipart parsing endpoint. The impact is limited to the application logic that consumes the parsed data. Because Mongoose is a library, the final impact depends entirely on how the embedding application processes filenames, Content-Type values, and body content — a poorly hardened application could escalate this to critical integrity impacts (e.g., arbitrary file write), while well-hardened apps would see negligible impact.

EPSS: Not yet scored by FIRST.org. No exploit-in-the-wild evidence reported; CISA KEV status is NO.

Detection Guidance

Sigma Rule

The following Sigma rule detects HTTP requests with unusual CR/LF sequences in multipart uploads:

title: Suspicious Lone CRLF in HTTP Multipart Upload — CVE-2026-73258
id: d4e2f9a1-7b3c-4d8e-9f01-2a5b6c7d8e9f
status: experimental
description: Detects HTTP POST requests with multipart/form-data containing lone carriage return or line feed characters adjacent to header/field values, indicating possible CVE-2026-73258 exploitation attempts.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-73258
author: Valters IT Security Research
date: 2026/01/15
logsource:
    category: webserver
    product: generic
detection:
    selection_method:
        http.method: POST
        http.content_type|startswith: 'multipart/form-data'
    selection_crlf:
        http.body|re: 'filename="[^"]*\r(?!\n)'   # lone CR in filename
        http.body|re: 'filename="[^"]*\n(?!\r)'   # lone LF in filename
    selection_boundary:
        http.body|re: 'boundary=.*\r(?!\n)'       # lone CR in boundary
    condition: selection_method and (selection_crlf or selection_boundary)
    timeframe: 10s
falsepositives:
    - Legitimate clients with broken multipart encoders
    - Non-compliant HTTP libraries on legacy systems
level: medium
tags:
    - attack.t1190
    - cve.2026-73258
    - cwe.697

YARA Rule

rule CVE_2026_73258_Mongoose_Multipart_CRLF_Truncation
{
    meta:
        author = "Valters IT Security Research"
        description = "Detects HTTP multipart payloads containing lone CR/LF characters within header or filename fields, indicative of CVE-2026-73258 exploitation attempts"
        date = "2026-01-15"
        cve = "CVE-2026-73258"
        severity = "medium"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73258"
    strings:
        $cr_in_filename = /filename="[^"]*\x0d(?!\x0a)/
        $lf_in_filename = /filename="[^"]*\x0a(?!\x0d)/
        $cr_in_content_type = /Content-Type: [^\r\n]*\x0d(?!\x0a)/
        $lf_in_content_type = /Content-Type: [^\r\n]*\x0a(?!\x0d)/
        $crlf_adjacent = /\x0d\x0d|\x0a\x0a/  // double CR or LF
    condition:
        uint16(0) == 0x0d0a and any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-73258 Mongoose Multipart Lone CRLF Truncation Attempt"; flow:established,to_server; http.method; content:"POST"; http.content_type; content:"multipart/form-data"; http.request_body; pcre:"/filename\s*=\s*\"[^\"]*\r(?!\n)/i"; pcre:"/filename\s*=\s*\"[^\"]*\n(?!\r)/i"; pcre:"/Content-Type\s*:\s*[^\r\n]*\r(?!\n)/i"; pcre:"/Content-Type\s*:\s*[^\r\n]*\n(?!\r)/i"; classtype:attempted-admin; sid:202673258; rev:1; reference:cve,2026-73258; metadata:attack_tactic TA0001, attack_technique T1190;)

Elastic Detection

Elastic EQL rule to detect multipart payloads with lone CR/LF characters:

sequence by host.name with maxspan=1m
  [ network where event.action == "connection_established" and destination.port == 80 ]
  [ http where
      http.request.method == "POST" and
      startsWith(http.request.headers.content_type, "multipart/form-data") and
      (wildcard(http.request.body, "*filename=*") and
        (http.request.body regex~ "filename=\"[^\"]*\r(?!\n)" or
         http.request.body regex~ "filename=\"[^\"]*\n(?!\r)" or
         http.request.body regex~ "Content-Type: [^\r\n]*\r(?!\n)" or
         http.request.body regex~ "Content-Type: [^\r\n]*\n(?!\r)"))
  ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=iis

| where method="POST" | where like(content_type, "multipart/form-data%") | regex _raw "(filename\s*=\s*"[^"]\r(?!\n))|(filename\s=\s*"[^"]\n(?!\r))|(Content-Type\s:\s*[^\r\n]\r(?!\n))|(Content-Type\s:\s*[^\r\n]*\n(?!\r))" | stats count by src_ip, uri_path, user_agent, _time | where count > 3 -- adjust threshold based on baseline | sort - _time

Wazuh OSSEC Rule

<rule id="100258" level="10">
  <if_sid>30600</if_sid>
  <regex>filename\s*=\s*"[^"]+\r(?!\n)</regex>
  <regex>filename\s*=\s*"[^"]+\n(?!\r)</regex>
  <description>CVE-2026-73258: Mongoose multipart parser anomaly — lone CR/LF in filename field</description>
  <group>web_application_attack</group>
  <cve>CVE-2026-73258</cve>
  <mitre><id>T1190</id><technique>Exploit Public-Facing Application</technique></mitre>
</rule>

<rule id="100259" level="10">
  <if_sid>30600</if_sid>
  <regex>Content-Type\s*:\s*[^\r\n]+\r(?!\n)</regex>
  <regex>Content-Type\s*:\s*[^\r\n]+\n(?!\r)</regex>
  <description>CVE-2026-73258: Mongoose multipart parser anomaly — lone CR/LF in Content-Type header</description>
  <group>web_application_attack</group>
  <cve>CVE-2026-73258</cve>
  <mitre><id>T1190</id><technique>Exploit Public-Facing Application</technique></mitre>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — A single source (OSV) claims the issue is fixed in version 7.22. This is not independently confirmed by the vendor's official advisory or a second source. Treat this with caution.

Immediate mitigations (no patch deployed yet):

1. Restrict multipart parsing: If file-upload functionality is not required, disable or block multipart/form-data requests at the reverse proxy or load balancer (Content-Type filtering).
2. Proxy-level normalization: Validate and strip lone CR/LF characters from multipart headers at a reverse proxy (e.g., Nginx/Apache filter) before the request reaches the Mongoose-embedded service.
3. Input validation: In the application layer, validate that Content-Type values and filenames match strict allowlists (e.g., only [a-zA-Z0-9._-]) and reject any that contain CR/LF characters.

Patch/Upgrade steps:

1. Upgrade Mongoose to version 7.22 or later — the version where the fix is claimed to be included.
2. Verify the patch independently by reviewing the mg_http_next_multipart() function in src/http.c — confirm the AND condition has been corrected to an OR condition in the described loops.
3. For embedded devices that bundle Mongoose, obtain the patched firmware release from the device vendor and schedule deployment in a maintenance window.

Long-term hardening:

1. Enable SSL/TLS to prevent network-level content injection and tampering of HTTP payloads.
2. Defense-in-depth: Treat all uploads as untrusted binary blobs — store them with random filenames, serve them with Content-Disposition: attachment and explicit X-Content-Type-Options: nosniff headers to prevent MIME sniffing.
3. Firmware lifecycle: Establish a process for tracking upstream vulnerabilities in embedded components; register vendor advisories and OSV feeds for Mongoose.
4. Monitoring: Deploy the detection rules above (Sigma/Elastic/Splunk/Wazuh) to identify in-the-wild exploitation attempts and anomalous multipart payloads.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-73258
2. OSV Vulnerability Entry (patch source): https://osv.dev/vulnerability/CVE-2026-73258 (single-source patch claim)
3. Mongoose GitHub Repository (verify fix in src/http.c): https://github.com/cesanta/mongoose
4. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. Shodan search surface for exposed Mongoose instances: https://www.shodan.io/search?query=product%3Amongoose

Exploit-in-the-wild evidence: None reported. No known threat actor campaigns. CISA KEV (Known Exploited Vulnerabilities) status: NO. EPSS: Not yet scored. PoC/Exploit availability: Public — No; Private — Unknown.