CVE-2026-73261

Executive Summary

CVE-2026-73261 is an improper input validation flaw in the embedded TCP/IP stack of Mongoose, an embedded web server and network library, prior to version 7.23. When compiled with MG_ENABLE_TCPIP and the built-in stack in src/net_builtin.c is used, a remote unauthenticated attacker can send a malformed TCP options field that causes an out-of-bounds read and corrupts the per-connection Maximum Segment Size (MSS) value. The result is silent application-layer data truncation or zero-length payload delivery on otherwise healthy-looking TCP connections, yielding a high-availability impact (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Technical Analysis

Mongoose ships an optional built-in TCP/IP stack that is enabled at compile time via the MG_ENABLE_TCPIP macro; the relevant parsing logic resides in src/net_builtin.c. The vulnerability is a length-validation failure (CWE-20) in the TCP option parsing routine handle_opt(). When a TCP segment carries an options list, each option is a TLV-style sequence where opts[0] is the option kind and opts[1] is the declared option length. The parser fails to verify that the declared opts[1] length is consistent with the number of remaining bytes in the options area.

The specific trigger described in the NVD entry is a NOP option followed by a truncated MSS option. Because the declared length exceeds the actual remaining option bytes, the parser reads opts[3] — a byte that lies outside the declared options area — and uses that out-of-bounds value as the low byte of the destination MSS (dmss) for the connection. This is fundamentally a bounded-buffer-over-read condition: the code trusts an attacker-controlled length field and indexes beyond the validated region.

The security consequence is not disclosed as memory corruption of control structures, but as logical state corruption: the per-connection MSS value is silently rewritten to an attacker-influenced value. Downstream, later mg_send() calls on that connection transmit truncated or zero-length application payloads, while the TCP connection itself remains established and continues to pass keepalive/handshake-level checks. From the peer application's perspective the connection appears healthy, masking the fact that application data is being lost or silently truncated.

The attack surface is any Mongoose-based service compiled with MG_ENABLE_TCPIP that accepts inbound TCP connections from untrusted networks. This is a pre-authentication flaw — no credentials, session, or prior negotiation are required. The vulnerability is network-reachable, low-complexity, and requires no user interaction, matching the AV:N/AC:L/PR:N/UI:N vector. Confidentiality and integrity subscores are None; the sole impact is availability (A:H). No public proof-of-concept, Nuclei template, or exploit code is currently known.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class, the NVD description, and the affected code path.

1. Reconnaissance / target identification. An attacker identifies a network service built on a Mongoose application compiled with the built-in TCP/IP stack (MG_ENABLE_TCPIP). Because the flaw lives in the TCP stack itself, identification may rely on fingerprinting the TCP behavior or the application banner rather than any HTTP-specific marker. The attacker only needs TCP reachability to the listening socket.

2. Triggering the flaw. During TCP connection establishment (or on any segment carrying options processed by handle_opt()), the attacker crafts a TCP options field containing a NOP followed by an MSS option whose declared opts[1] length exceeds the remaining option bytes. The malformed option is accepted rather than rejected, and the parser reads opts[3] outside the declared options area, using that byte as the low byte of the connection's dmss value.

3. Payload / execution method. This is not a code-execution primitive. The "payload" is the malformed TCP option itself. The attacker's goal is the side effect on dmss: an attacker-influenced MSS value on the victim's connection. Subsequent mg_send() calls inherit this corrupted MSS and emit truncated or zero-length application payloads. The attacker supplies no application-layer content to achieve the effect; the corruption is established at the transport parsing layer.

4. Post-exploitation impact. The victim service continues to hold a nominally healthy TCP connection while silently dropping or truncating application data. Depending on the application, this can cause data loss, stalled request/response cycles, protocol desynchronization, incorrect responses, or denial of service for legitimate clients. Because the integrity of the connection state is compromised without any visible TCP error, downstream monitoring that relies on connection liveness may not flag the condition.

Impact Assessment

The CVSS v3.1 base score is 7.5 (High), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. This reflects a network-reachable, low-complexity, unauthenticated attack requiring no user interaction, scoped to the affected component, with a high availability impact and no direct confidentiality or integrity impact.

Business impact is concentrated on availability and data fidelity of Mongoose-based embedded services: industrial gateways, IoT edge devices, embedded web servers, and other appliances that ship Mongoose with the built-in TCP/IP stack. For such deployments, silent application-payload truncation or zero-length transmission can break control protocols, corrupt telemetry, or render management interfaces unreliable. Because the connection continues to appear healthy, operators may misattribute the symptoms to application bugs rather than an active network attack, extending time-to-diagnosis.

Blast radius is limited per-connection but scales with connection volume: an attacker can repeatedly open or manipulate connections to degrade many sessions, and because no authentication is needed, any internet- or WAN-exposed instance compiled with MG_ENABLE_TCPIP is a candidate target. There is no privilege escalation, lateral movement, or data exfiltration implied by the described mechanism.

Detection Guidance

Sigma Rule

title: Suspicious TCP Option Anomaly Targeting Mongoose Built-in Stack
id: 7c2b9a41-1e37-4e2a-9c6d-5b8f0a2d3e11
status: experimental
description: Detects malformed TCP option sequences (NOP followed by truncated MSS option) targeting Mongoose services with MG_ENABLE_TCPIP
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73261
author: valtersit.com threat intelligence
logsource:
  category: network_connection
  product: zeek
detection:
  selection_nop_mss:
    tcp.option_kind|contains:
      - '1'
      - '2'
    tcp.option_len_invalid: true
  condition: selection_nop_mss
falsepositives:
  - Legitimate but uncommon TCP option padding from non-standard stacks
level: medium
tags:
  - attack.t1190

YARA Rule

rule CVE_2026_73261_Mongoose_TCP_Option
{
    meta:
        description = "Detects Mongoose built-in TCP stack option parsing code associated with CVE-2026-73261"
        author = "valtersit.com threat intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73261"
        date = "2026-01-01"
        severity = "high"

    strings:
        $a = "MG_ENABLE_TCPIP"
        $b = "handle_opt"
        $c = "net_builtin"
        $d = "dmss"
        $e = "mongoose"

    condition:
        uint32be(0) == 0x7F454C46 or uint16be(0) == 0x4D5A or true
        and any of ($a, $b, $c, $d)
        and $e
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-73261 Mongoose TCP NOP+truncated MSS option anomaly"; flow:established,to_server; byte_test:1,=,1,0,relative; byte_test:1,>,0,1,relative; classtype:attempted-dos; reference:cve,2026-73261; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73261; sid:202673261; rev:1;)

Elastic Detection

network where process.name == "mongoose" or destination.port == 80 or destination.port == 8080
and tcp.option.kind == 1 and tcp.option.length_invalid == true

Splunk SPL Query

index=network sourcetype=suricata OR sourcetype=zeek
| search (alert.signature="*CVE-2026-73261*" OR event.dataset="tcp.option")
| where match(tcp_options, "(?i)nop.*mss")
| stats count by src_ip, dest_ip, dest_port
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="cve,mongoose,">
  <rule id="100261" level="10">
    <decoded_as>json</decoded_as>
    <field name="tcp.option.anomaly">truncated_mss</field>
    <description>CVE-2026-73261: Malformed TCP NOP+MSS option targeting Mongoose built-in stack</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_73261,mongoose,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix has been recorded by tracked sources for this identifier at time of writing; the NVD description states the issue is fixed in version 7.23.

1. Immediate mitigations.

   • Where feasible, disable the built-in TCP/IP stack by not compiling with MG_ENABLE_TCPIP, delegating TCP handling to a hardened host or OS network stack. This removes the vulnerable code path entirely.
   • Restrict network exposure of Mongoose-based services: place them behind segmentation, VPNs, or authenticated gateways so untrusted peers cannot reach the TCP listener.
   • Apply egress/ingress filtering to limit which hosts can open connections to affected services.
   • Deploy the Suricata/Sigma/Wazuh detections above to flag malformed NOP+MSS option sequences and anomalous connection health.

2. Patch/upgrade steps.

   • Upgrade Mongoose to 7.23 or later, which addresses the handle_opt() length-validation failure and removes the out-of-bounds opts[3] read.
   • Rebuild all applications that statically link or embed Mongoose against the updated version; confirm src/net_builtin.c reflects the corrected validation logic.
   • Re-verify firmware images for embedded devices that bundle Mongoose and schedule vendor firmware updates where available.

3. Long-term hardening.

   • Enforce strict bounds validation on all attacker-controlled length fields in protocol parsers.
   • Adopt fuzzing for the built-in network stack (option parsing, segmentation) as part of CI.
   • Maintain an SBOM to track embedded third-party libraries such as Mongoose for rapid CVE triage.
   • Monitor the project's release channel and CVE feeds for 7.23+ advisories given the initially unpatched status of this record.

References

• NVD — CVE-2026-73261: https://nvd.nist.gov/vuln/detail/CVE-2026-73261
• Mongoose project repository (src/net_builtin.c, handle_opt parsing): https://github.com/cesanta/mongoose
• CWE-20 — Improper Input Validation: https://cwe.mitre.org/data/definitions/20.html
• CISA KEV Catalog (verify status; not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (not yet scored at time of writing): https://www.first.org/epss/

No public proof-of-concept, Nuclei template, exploit code, or in-the-wild campaign activity is currently associated with CVE-2026-73261 based on available data.