CVE-2023-34188

2023-06-2300:00:00

mitre

www.cve.org

http server

mongoose

vulnerability

infinite loop

attack payload

tcp

content-length

reparsing

security issue

EPSS

0.001

Percentile

50.5%

JSON

The HTTP server in Mongoose before 7.10 accepts requests containing negative Content-Length headers. By sending a single attack payload over TCP, an attacker can cause an infinite loop in which the server continuously reparses that payload, and does not respond to any other requests.