The vulnerability arises from an incorrect AND condition in loops comparing characters in multipart input, specifically in mg_http_next_multipart() in src/http.c of mongoose. The loops stop when either character resembles part of a CRLF terminator, causing truncation of multipart headers, filenames, or boundaries. This truncation can mislead the application into accepting malicious content based on a false Content-Type. The flaw is resolved in mongoose version 7.22.

An attacker can remotely exploit this flaw by sending specially crafted multipart input containing a lone carriage return or line feed. This can cause the application to truncate multipart headers or boundaries incorrectly, potentially allowing dangerous content to be accepted under misleading Content-Type headers. The impact includes limited confidentiality and integrity loss but no availability impact, as reflected by the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).

This vulnerability is fixed in mongoose version 7.22. Users should upgrade to version 7.22 or later to remediate this issue. Patch status is not explicitly confirmed in the provided data, but the vendor states the issue is fixed in 7.22. No other mitigation or temporary workaround is indicated.