CVE-2026-73260 Mongoose: Out-of-bounds Read via length-counter underflow in built-in TLS X.509 DER parser

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MGTLSBUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mgdertotlv and mgdernext, a peer-controlled length can advance t...

CVE-2026-73260

The Mongoose embedded web server and network library is vulnerable to an out-of-bounds read due to a length-counter underflow in its built-in TLS X.509 DER parser (prior to version 7.23 ). Specifically, the functions mg_der_to_tlv() and mg_der_next() fail to verify if a long-form DER element leng...