CVE-2026-73260

Executive Summary

CVE-2026-73260 is an out-of-bounds read (CWE-125) in the built-in TLS certificate parser of Mongoose, an embedded web server and network library, affecting versions prior to 7.23. When the MG_TLS_BUILTIN TLS implementation is selected, a peer-controlled long-form DER length field can advance the parser past the end of the certificate buffer and underflow the remaining length counter, causing mg_tls_parse_cert_der() to walk an invalid pointer during the TLS handshake. An unauthenticated malicious TLS server, or a client presenting a crafted certificate to a server configured for client certificate authentication, can trigger a denial of service; the vulnerability carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Technical Analysis

Mongoose embeds a lightweight TLS stack that can be used instead of OpenSSL/mbedTLS when MG_TLS_BUILTIN is selected. Prior to version 7.23, the DER certificate parser used by this stack fails to validate that a long-form DER element length fits within the remaining certificate buffer. The two affected parsing helpers are mg_der_to_tlv() and mg_der_next(). In a DER TLV (type-length-value) structure, the length field can be encoded in short form or long form; long form uses a leading byte with the high bit set followed by one or more length bytes. If an attacker supplies a long-form length that is larger than the actual remaining buffer, the parser's internal offset advances beyond the certificate and the remaining uint32_t length is underflowed (wraps to a very large value). Because mg_tls_parse_cert_der() trusts this remaining length, it continues to walk an invalid pointer rather than terminating the parse.

The vulnerability is an out-of-bounds read. The parser reads beyond the allocated certificate buffer, which may cause a crash, an infinite/erroneous parse loop, or process instability during the handshake. It is a memory-safety defect in the certificate-length validation logic, not an authentication-bypass or code-execution flaw. The CVSS vector reflects network reachability (AV:N), no privileges or user interaction required (PR:N/UI:N), and high availability impact (A:H) with no confidentiality or integrity impact (C:N/I:N/A:H), consistent with a denial-of-service condition.

The attack surface is the TLS handshake certificate exchange. Two exposure modes exist: (1) outbound — a Mongoose client connecting to an attacker-controlled TLS server that presents a malicious certificate chain, and (2) inbound — a Mongoose server configured to request/require client certificates, where the connecting peer presents the crafted certificate. In both cases the vulnerable MG_TLS_BUILTIN parser processes attacker-influenced DER data before any trust decision is finalized.

Exploitation Scenarios

No public PoC or exploit code is available (POC_STATUS: None); the following attack chain is inferred from the vulnerability class and the vendor description.

1. Reconnaissance / target identification. The attacker identifies a Mongoose-based endpoint that uses the built-in TLS stack (MG_TLS_BUILTIN) rather than an external TLS library. Candidate targets are embedded/IoT devices or network services embedding Mongoose and exposing TLS. Depending on deployment, the attacker either (a) controls (or compromises) a TLS server that a Mongoose client will connect to, or (b) connects directly to a Mongoose server that requests client certificates.

2. Triggering the flaw. During the TLS handshake, the attacker presents a certificate containing a DER element whose long-form length field exceeds the actual remaining buffer. Because mg_der_to_tlv() / mg_der_next() do not verify that the declared length fits within the remaining certificate data, the parser advances past the buffer and the remaining uint32_t length underflows.

3. Execution method at the vulnerability-class level. mg_tls_parse_cert_der() continues iterating over the now-invalid pointer, producing an out-of-bounds read. This is a malformed-input condition delivered through the handshake — no authentication, credentials, or user interaction are required.

4. Post-exploitation impact. The out-of-bounds read leads to a denial of service: the handshake fails abnormally, the process may crash or enter an unstable parse loop, and TLS availability is degraded. The vector reports no confidentiality or integrity impact, so this is not an information-disclosure or code-execution primitive based on the available data. Repeated handshake attempts could sustain availability loss.

Impact Assessment

Successful exploitation yields a denial-of-service condition against Mongoose-based TLS endpoints. With CVSS 3.1 = 7.5 (High), the subscore analysis is: Attack Vector Network (remotely reachable over TLS), Attack Complexity Low (the malicious certificate is the only special condition), Privileges Required None, User Interaction None, Scope Unchanged, Confidentiality None, Integrity None, Availability High. Because MG_TLS_BUILTIN is a popular choice on resource-constrained embedded and IoT deployments, blast radius concentrates on devices that (a) use the built-in stack and (b) either initiate outbound TLS to untrusted peers or accept client certificates. A crash or handshake loop on such devices can disrupt management interfaces, telemetry, or device-to-cloud connectivity. No EPSS score is available (not yet scored by FIRST.org); CISA KEV listing is absent; no evidence of in-the-wild exploitation was provided.

Detection Guidance

Sigma Rule

title: Mongoose TLS DER Parser Out-of-Bounds Read (CVE-2026-73260)
id: 9f2b0c41-7c6a-4a1e-9b2d-3e5f8a1d4c77
status: experimental
description: Detects process crashes or anomalous TLS handshake failures consistent with the Mongoose MG_TLS_BUILTIN DER length OOB read.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73260
author: valtersit.com
date: 2026/01/01
logsource:
  category: application
  product: mongoose
detection:
  selection_msg:
    message|contains:
      - 'mg_tls_parse_cert_der'
      - 'mg_der_to_tlv'
      - 'mg_der_next'
  selection_signal:
    message|contains:
      - 'Segmentation fault'
      - 'SIGSEGV'
      - 'SIGABRT'
      - 'out of bounds'
      - 'TLS handshake failed'
  condition: selection_msg or selection_signal
falsepositives:
  - Legitimate TLS handshake failures with malformed but benign certificates
  - Memory errors from unrelated components
level: high
tags:
  - attack.t1190
  - cve.2026.73260

YARA Rule

rule CVE_2026_73260_Mongoose_DER_Parser
{
    meta:
        description = "Detects Mongoose binaries referencing the vulnerable built-in TLS DER parser symbols (CVE-2026-73260)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73260"
        cve = "CVE-2026-73260"

    strings:
        $s1 = "mg_tls_parse_cert_der" ascii
        $s2 = "mg_der_to_tlv" ascii
        $s3 = "mg_der_next" ascii
        $s4 = "MG_TLS_BUILTIN" ascii

    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F
        and 2 of ($s*)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-73260 Mongoose MG_TLS_BUILTIN DER long-form length OOB read attempt"; flow:established,to_server; content:"|16 03|"; depth:2; content:"|0b|"; within:5; pcre:"/\x30\x82[\x80-\xff]{2}/R"; classtype:attempted-dos; reference:cve,2026-73260; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73260; sid:202673260; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=10s
  [process where event.action == "start" and process.name != null]
  [file where event.category == "file" and file.name like~ "*.pem" and
     process.name in ("mongoose", "mg_http_listen", "mongoose_app")]

Splunk SPL Query

index=app_logs (source=*mongoose* OR sourcetype=mongoose*)
| search "mg_tls_parse_cert_der" OR "mg_der_to_tlv" OR "mg_der_next" OR "TLS handshake failed" OR "segmentation fault"
| stats count min(_time) as first_seen max(_time) as last_seen by host, src_ip, dest_port, message
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="mongoose,tls,">
  <rule id="2026732" level="10">
    <decoded_as>syslog</decoded_as>
    <match>mg_tls_parse_cert_der|mg_der_to_tlv|mg_der_next</match>
    <description>CVE-2026-73260: Mongoose MG_TLS_BUILTIN DER parser anomaly - possible out-of-bounds read / DoS</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="2026733" level="12">
    <decoded_as>syslog</decoded_as>
    <match>signal 11|SIGSEGV|segmentation fault</match>
    <regex>mongoose|mg_tls</regex>
    <description>CVE-2026-73260: Mongoose process crash consistent with DER OOB read exploitation</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Per the vendor description, the issue is stated to be fixed in Mongoose version 7.23; no independent patch evidence was available from tracked sources at the time of writing.

1. Immediate mitigations

• Upgrade Mongoose to version 7.23 or later where feasible; treat this as the vendor-stated fix.
• Where upgrade cannot be applied immediately, do not select MG_TLS_BUILTIN. Use an external, maintained TLS backend (OpenSSL or mbedTLS) for TLS termination until the built-in parser version is updated.
• Remove or disable TLS client-certificate requirement on Mongoose endpoints that do not strictly need it, reducing the inbound attack surface (a peer presenting a certificate).
• Restrict outbound TLS connectivity from Mongoose-based clients to trusted, allowlisted servers to mitigate the malicious-server attack path.
• Apply process supervision/restart and resource limits so a crashed handshake degrades gracefully rather than taking down the device.

2. Patch / upgrade steps

• Identify all embedded deployments using Mongoose with the built-in TLS stack.
• Update the library to 7.23 (or the latest available version) and rebuild dependent firmware/applications.
• Verify the build selects a fixed TLS backend and re-test the client and server certificate-handling paths.

3. Long-term hardening

• Track the Mongoose project for the exact 7.23 release artifact and any backports to validate patch provenance.
• Treat all DER input (including length fields) as untrusted: enforce bound checks whenever parsing length values.
• Favor widely audited TLS stacks for exposed management interfaces.
• Add handshake-failure and process-crash alerting to monitoring (see Detection Guidance) and fuzz DER/TLS parsing in CI.

References

• NVD — CVE-2026-73260: https://nvd.nist.gov/vuln/detail/CVE-2026-73260
• MITRE CWE-125 — Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
• Mongoose project repository / release history (consult official release notes for 7.23): https://github.com/cesanta/mongoose
• FIRST EPSS: Not yet scored for CVE-2026-73260 (no value available at time of writing)
• CISA Known Exploited Vulnerabilities catalog: Not listed (no KEV entry)

No public proof-of-concept, exploit code, Nuclei template, or confirmed in-the-wild campaign was identified in the provided intelligence. The attack chain described is inferred from the vulnerability class and vendor description.