Is CVE-2026-73253 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73253 being exploited in the wild.

How severe is CVE-2026-73253?

Informational severity, with a CVSS score of 6.5, published 20 August 2026.

Is there a fix for CVE-2026-73253?

A patch was published on 2026-06-23: Fix committed to Mongoose master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73253 attacked?

It is attacked over the network.

Am I affected by CVE-2026-73253?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73253: Mongoose wildcard certificate hostname verification bypass

CVE-2026-73253 · Severity: info · CVSS 6.5 · Published 2026-08-20

Mongoose is a lightweight embedded web server used in IoT devices, firmware, and networked applications. An attacker on the network path with a wildcard certificate for a parent domain can impersonate subdomains to client applications, allowing interception and modification of TLS-encrypted traffic. This breaks the security guarantee that connections are made to the intended server.

Quick answers

Is CVE-2026-73253 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73253 being exploited in the wild.
How severe is CVE-2026-73253?: Informational severity, with a CVSS score of 6.5, published 20 August 2026.
Which products and versions are affected?: Cesanta Mongoose before 7.22.
Is there a fix for CVE-2026-73253?: A patch was published on 2026-06-23: Fix committed to Mongoose master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73253 attacked?: It is attacked over the network.
Am I affected by CVE-2026-73253?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a hostname verification bypass in Mongoose's built-in TLS stack. The mg_tls_verify_cert_san() and mg_tls_verify_cert_cn() functions in src/tls_builtin.c use mg_match() to validate certificate hostnames, but the wildcard matching is overly permissive—allowing a pattern like *.example.com to incorrectly match foo.bar.example.com (crossing DNS label boundaries). An on-path network attacker with a wildcard certificate for a parent domain can exploit this to perform man-in-the-middle attacks against clients. The vulnerability requires network adjacency and does not require authentication or user interaction. The issue was fixed in version 7.22.

Affected products

Cesanta Mongoose before 7.22

Timeline

2026-08-20: disclosed: CVE-2026-73253 published
2026-06-23: patched: Fix committed to Mongoose master branch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.