CVE-2026-73251

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 7.23

Description A network attacker can impersonate a TLS server to a client configured with a multi-certificate CA bundle. In the src/tls builtin.c file, the mg tls init() function stores the bundle in tls->ca bundle der while tls->ca der.len remains zero. Subsequently, mg tls recv cert() utilizes tls bundle find() to accept a Common Name match without invoking mg tls verify cert signature(). This allows a forged self-signed certificate to satisfy hostname and CertificateVerify checks, potentially leading to traffic interception, credential disclosure, traffic modification, and malicious responses.

Recommendations Update to version 7.23.