CVE-2026-73256

A CRITICAL severity flaw was found in Mongoose, an embedded web server and networking library, affecting Red Hat community offerings. The only current Red Hat affect is the mongoose package in Fedora, a community-maintained product; Red Hat's shipping data shows this component only in community streams, so no Red Hat Enterprise Linux or other supported product is affected. Mongoose contains an off-by-one error in HTTP protocol version validation: the http_cb() function in src/http.c tests the parsed protocol string length against an impossible greater-than-eight condition even though mg_http_parse() produces an eight-byte protocol string, so HTTP/1.0 requests are never identified. As a result, when Mongoose is deployed behind an HTTP/1.0 reverse proxy, it processes Transfer-Encoding: chunked framing that the proxy ignores. A remote, unauthenticated attacker can exploit this by sending specially crafted requests with conflicting message framing headers to perform HTTP request smuggling, potentially gaining unauthorized access, bypassing security controls, or altering application state. Red Hat rates this flaw Critical (CVSS 3.1 score of 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), consistent with the upstream severity. Because the affected package is community-maintained, a fix is being pursued through the delegated community maintenance process for Fedora.