Mongoose, an embedded web server, incorrectly handled HTTP/1.0 requests before version 7.22. An unauthenticated attacker can send a specially crafted Transfer‑Encoding: chunked request that causes the server to treat the traffic as HTTP/1.1, while an HTTP/1.0 reverse proxy ignores the TE header. This off‑by‑one flaw allows the request to be smuggled past the proxy and executed on the back‑end, granting the attacker unauthorized actions such as data modification or session hijacking. The weakness is a request smuggling flaw (CWE‑444).

Cesanta Mongoose web server versions prior to 7.22 are affected. The fix was introduced in release 7.22, and any deployment using an older version of Mongoose remains vulnerable.

The CVSS score is 9.1, reflecting a critical severity. EPSS information is not available, but the flaw requires only an unauthenticated, remote attacker to send a crafted request to the Mongoose instance, typically exposed on a standard HTTP port behind an HTTP/1.0 reverse proxy. The vulnerability is not yet listed in the CISA KEV catalog, yet its high CVSS and the straightforward exploit path mean that an attacker could readily cause unauthorized state changes or data corruption. The likely attack vector is a remote request sent through a proxy that strips Transfer‑Encoding headers in HTTP/1.0 traffic.