CVE-2026-115473

The Mongoose embedded web server and network library (prior to version 7.22 ) contains a heap out-of-bounds read and a null-byte bypass in the mg_path_is_sane function located in src/util.c. The vulnerability occurs because the software fails to verify that path.len is at least two before reading...

DEBIAN-CVE-2026-73255

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an include file or include virtual directive. The mgssi function in src/ssi.c concatenates the directive argument into a filesystem pat...