# CVE-2026-73260: Mongoose TLS certificate parser bounds check in DER parsing

Source: https://junglewise.ai/threats/cve-2026-73260-mongoose-is-an-embedded-web-server-and-network-library-prior-to-7  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-73260 · Severity: high · CVSS 7.5 · Published 2026-10-14

Mongoose is an embedded web server and network library used in IoT and embedded systems. Prior to version 7.23, its built-in TLS certificate parser has a bounds checking flaw that allows an attacker to cause an out-of-bounds memory read and crash the server during the TLS handshake. An unauthenticated malicious TLS server, or any peer presenting a crafted certificate, can exploit this to cause a denial of service.

Technologies: [Cesanta Mongoose](https://junglewise.ai/threats/technologies/cesanta-mongoose). Vendors: [Cesanta](https://junglewise.ai/threats/vendors/cesanta).

## Quick answers

**Is CVE-2026-73260 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73260 being exploited in the wild.

**How severe is CVE-2026-73260?** High severity, with a CVSS score of 7.5, published 14 October 2026.

**Which products and versions are affected?** Cesanta Mongoose before 7.23.

**Is there a fix for CVE-2026-73260?** Yes: fixed in 7.23. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73260 attacked?** It is in a software library.

**Am I affected by CVE-2026-73260?** Check whether you run Cesanta Mongoose at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7.23

## Technical details

The vulnerability exists in mg_der_to_tlv() and mg_der_next() functions within the TLS certificate parser when MG_TLS_BUILTIN is selected. When parsing long-form DER element lengths, the parser fails to validate that the specified length fits within the remaining certificate buffer, allowing a peer-controlled length value to underflow a uint32_t and cause the parser to advance beyond valid memory boundaries during certificate parsing. An unauthenticated attacker can send a malicious TLS server response or client certificate to trigger an out-of-bounds read and denial of service.

## Affected products

- Cesanta Mongoose before 7.23

## Timeline

- 2026-10-14: disclosed
- 2026-08-12: patched: Version 7.23 released

## References

- [https://github.com/cesanta/mongoose/commit/a8b4ae95db3c2db85e5ad9db3fefaeebb5f7b43e](https://github.com/cesanta/mongoose/commit/a8b4ae95db3c2db85e5ad9db3fefaeebb5f7b43e)
- [https://github.com/cesanta/mongoose/releases/tag/7.23](https://github.com/cesanta/mongoose/releases/tag/7.23)

## Related threats

- [Mongoose heap out-of-bounds read in path validation](https://junglewise.ai/threats/cve-2026-115473-mongoose-is-an-embedded-web-server-and-network-library-prior-to)
- [Mongoose TCP option parser bounds check vulnerability](https://junglewise.ai/threats/cve-2026-73261-mongoose-is-an-embedded-web-server-and-network-library-prior-to-7)
- [Mongoose TLS short-record out-of-bounds read](https://junglewise.ai/threats/cve-2026-73252-mongoose-is-an-embedded-web-server-and-network-library-prior-to-7)
- [Mongoose IPv6CP length field bounds check buffer overflow](https://junglewise.ai/threats/cve-2026-63626-mongoose-is-an-embedded-web-server-and-network-library-prior-to-7)
- [Cesanta Mongoose stack-based buffer overflow in MQTT broker](https://junglewise.ai/threats/cve-2026-101003-a-weakness-has-been-identified-in-cesanta-mongoose-up-to-7-21)