Bug 2553625

Summary: CVE-2026-73261 mongoose: mongoose: Denial of Service via malformed TCP options [fedora-all]
Product: [Fedora] Fedora Reporter: Vladimir Vasilev <vvasilev>
Component: mongooseAssignee: Orphan Owner <extras-orphan>
Status: NEW --- QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: high    
Version: rawhideCC: cz172638, extras-orphan, fedora
Target Milestone: ---Keywords: Security, SecurityTracking
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard: {"flaws": ["15effb0a-c0b9-4fb3-b2a5-6fbf774d0752"]}
Fixed In Version: Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2552781    

Description Vladimir Vasilev 2026-10-15 17:32:12 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP in src/net_builtin.c does not reject a TCP option whose declared opts[1] length exceeds the remaining option bytes. In handle_opt(), a NOP followed by a truncated MSS option causes opts[3] to be read outside the declared options area and used as the low byte of dmss. An unauthenticated remote peer can corrupt the per-connection MSS value so later mg_send() calls transmit truncated or zero-length application payloads while the TCP connection otherwise appears healthy. This issue is fixed in version 7.23.