Bug 2552781 (CVE-2026-73261)

Summary: CVE-2026-73261 mongoose: mongoose: Denial of Service via malformed TCP options
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Mongoose. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service (DoS) by sending network packets with malformed TCP options. Due to improper length validation in the built-in TCP/IP stack, these crafted packets corrupt connection settings, specifically the Maximum Segment Size (MSS). Consequently, the server transmits truncated or empty data payloads over affected connections, disrupting normal communications while the connection appears healthy.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2553625    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-14 18:42:23 UTC 
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP in src/net_builtin.c does not reject a TCP option whose declared opts[1] length exceeds the remaining option bytes. In handle_opt(), a NOP followed by a truncated MSS option causes opts[3] to be read outside the declared options area and used as the low byte of dmss. An unauthenticated remote peer can corrupt the per-connection MSS value so later mg_send() calls transmit truncated or zero-length application payloads while the TCP connection otherwise appears healthy. This issue is fixed in version 7.23.