A remote unauthenticated attacker can craft an HTTP request that contains both a Content-Length header and a Transfer-Encoding: chunked header. The Mongoose request parser accepts both headers and gives precedence to the chunked encoding. A reverse proxy that prefers the Content-Length header can thus interpret the request body boundary differently, allowing the attacker to smuggle a second request into the original one. This desynchronization enables the attacker to inject requests that access or modify resources belonging to another user or context, potentially leading to unauthorized data access or modification.

All installations of the Cesanta Mongoose embedded web server and network library running any version prior to 7.22 are vulnerable. Mongoose is used in embedded devices, IoT gateways and other networked applications that integrate the library.

The vulnerability scores a CVSS of 9.1, indicating a high severity compromise of confidentiality, integrity, and availability. No EPSS data is published, and the issue is not yet listed in CISA's KEV catalog. The nature of the flaw means it can be exploited remotely over any HTTP interface without authentication, making the risk high for exposed services. Attackers could send the crafted request to smuggle a second request, bypassing authentication controls and causing unauthorized actions.