CVE-2026-73256

The root cause of CVE-2026-73256 is not a parsing flaw but a dead-code logic error in HTTP/1.0 version detection that created a request smuggling vector. The condition `proto.len > 8` in http_cb() is provably unreachable: the "HTTP/1.0" protocol string is exactly 8 bytes, and mg_http_parse() enforces exactly 8 bytes for valid requests. This means the is_http_1_0 flag can never be set through normal request processing, permanently disabling the version guard that should prevent chunked encoding processing for HTTP/1.0 clients. This appears to be a case of "layered assumption decay" — a defensive check that survived a refactor of its precondition. The guard was likely written with defensive intent, then mg_http_parse() was tightened to require exactly 8 bytes (probably as a separate correctness fix), and the guard was never updated because it "looked fine." This is a recurring pattern in CVE history: the deliberate disable. Someone wrote that condition as a TODO stub during a refactor, intending to revisit it later, and it calcified into critical dead code when the author moved to another task. The smuggling impact depends on a specific topology: an HTTP/1.0 reverse proxy upstream. Proxies that speak only HTTP/1.0 should terminate chunked bodies, but Mongoose's broken detection interprets them anyway, creating interpretation mismatches. However, the CVSS 9.1 may actually understate the systemic risk. The broken guard doesn't just enable smuggling — it acts as an active misclassification engine. Every downstream system in the request pipeline that branches on HTTP version — logging systems, access control layers, rate limiters, WAFs — operates on corrupted metadata. The ambient misclassification occurs any time an HTTP/1.0 client sends a chunked body, regardless of whether smuggling is the attacker's goal. The fix in 7.22 likely restructured the version check placement rather than just tweaking the condition. Examine the actual diff: was this a one-line condition change or a refactoring of how HTTP version is tracked through the request pipeline? Also audit whether is_http_1_0 feeds into persistent state — connection pools, session objects, or log fields that survive the request lifecycle. If corrupted version state persists across requests, the smuggling vector may be exploitable even without a compliant upstream proxy.

Reviewed through automated stages and approved by a human before publication.