CVE-2026-73253

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 7.22

Description An on-path network attacker possessing a wildcard certificate for a parent domain can impersonate deeper subdomains to a client utilizing the built-in TLS stack. This occurs because the mg tls verify cert san() and mg tls verify cert cn() functions in src/tls builtin.c utilize the mg match() function, which allows wildcards to cross DNS label boundaries. Consequently, a pattern like *.example.com may incorrectly match foo.bar.example.com, leading to a hostname verification bypass that enables the interception and modification of TLS traffic.

Recommendations Update to version 7.22.