A logic error in the multipart parsing routine caused by the incorrect AND operator in mg_http_next_multipart() allows an attacker to insert a solitary carriage return or line feed into a multipart request. The loops that compare characters stop prematurely when either position matches part of a CRLF terminator, truncating headers, filenames, or boundary delimiters. As a result the application may accept data whose Content-Type header has been manipulated, effectively bypassing defenses that rely on correct header parsing. This vulnerability is identified as CWE‑697, an incorrect logical operator condition.

The flaw exists in the Cesanta Mongoose embedded web server and network library in all versions released prior to 7.22. Applications that embed or link against these older versions can be exposed to the validation bypass. The affected releases include 7.21 and earlier.

The impact score is 6.5, indicating a moderate severity. The EPSS score is currently unavailable, and the issue is not listed in CISA’s Known Exploited Vulnerabilities catalog, suggesting no widespread exploitation to date. The vulnerability is remotely exploitable over HTTP, requiring the ability to send a crafted multipart payload. While it does not directly lead to denial of service or immediate code execution, the ability to inject malicious content can aid in other attacks, making it a noteworthy concern for systems handling untrusted input.