CVE-2026-73258

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mghttpnextmultipart in src/http.c. The loops comparing sb and sb + 1, and sh2 and sh2 + 1, use an incorrect AND condition and stop...

DEBIAN-CVE-2026-73258

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mghttpnextmultipart in src/http.c. The loops comparing sb and sb + 1, and sh2 and sh2 + 1, use an incorrect AND condition and stop...

CVE-2026-73258 Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mghttpnextmultipart in src/http.c. The loops comparing sb and sb + 1, and sh2 and sh2 + 1, use an incorrect AND condition and stop...

CVE-2026-73258 Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mghttpnextmultipart in src/http.c. The loops comparing sb and sb + 1, and sh2 and sh2 + 1, use an incorrect AND condition and stop...

CVE-2026-73258

In Mongoose prior to 7.22, mg_http_next_multipart() in src/http.c uses an incorrect AND condition when scanning for CRLF terminators in multipart input. A lone carriage return or line feed causes premature truncation of headers, filenames, or boundaries, allowing an attacker to present a misleadi...

CVE-2026-73258

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mghttpnextmultipart in src/http.c. The loops comparing sb and sb + 1, and sh2 and sh2 + 1, use an incorrect AND condition and stop...

EUVD-2026-63495

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mghttpnextmultipart in src/http.c. The loops comparing sb and sb + 1, and sh2 and sh2 + 1, use an incorrect AND condition and stop...

CVE-2026-73258 Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mghttpnextmultipart in src/http.c. The loops comparing sb and sb + 1, and sh2 and sh2 + 1, use an incorrect AND condition and stop...

PT-2026-79082

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mg http next multipart in src/http.c. The loops comparing sb and sb + 1, and sh2 and sh2 + 1, use an incorrect AND condition and...

CVE-2026-19484

A flaw was found in @fastify/busboy, a multipart form-data parser. A remote, unauthenticated attacker can exploit this by sending a specially crafted multipart request with an oversized boundary. This can cause the Node.js event loop to stall, leading to a CPU-bound loop that consumes significant...

io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service

A flaw was found in Quarkus REST. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted multipart/form-data request with an excessively large header section. This unbounded accumulation of MIME part-header bytes can exhaust the Java Virtual Machine JVM heap memory...

EUVD-2026-48753

A flaw was found in libsoup. An unsigned integer underflow in the soupfilterinputstreamreaduntil function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client...

Linux Distros Unpatched Vulnerability : CVE-2026-12548

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soupheadersparse can...

DEBIAN-CVE-2026-66337

A flaw was found in libsoup. An unsigned integer underflow in the soupfilterinputstreamreaduntil function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client...

CVE-2026-66337

Summary: Libsoup contains a flaw where an unsigned integer underflow in soup_filter_input_stream_read_until() leads to a heap buffer over-read while parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client a...

CVE-2026-66337

A flaw was found in libsoup. An unsigned integer underflow in the soupfilterinputstreamreaduntil function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client...

SUSE CVE-2026-12548

A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soupheadersparse can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to cras...

CVE-2026-12548

A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soupheadersparse can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to cras...

DEBIAN-CVE-2026-12548

A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soupheadersparse can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to cras...

UBUNTU-CVE-2026-12548

A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soupheadersparse can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to cras...