Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_http_parse() and http_cb() paths in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy can use a different request boundary. This CL.TE desynchronization can inject requests that access or modify resources in another user context. This issue is fixed in version 7.22.

A HTTP request smuggling vulnerability (CL.TE desynchronization) exists in Mongoose, an embedded web server and network library, prior to version 7.22. A remote unauthenticated attacker can craft an HTTP request containing both Content-Length and Transfer-Encoding: chunked headers. The mg_http_parse() and http_cb() functions in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy may interpret request boundaries differently. This mismatch allows an attacker to inject smuggled requests that can access or modify resources belonging to other users. The vulnerability requires no authentication to exploit and can lead to unauthorized data access or modification in another user's context. The issue has been patched in Mongoose version 7.22, with a fix available via the official GitHub repository.