# CVE-2026-73253: Mongoose wildcard certificate hostname verification bypass

Source: https://junglewise.ai/threats/cve-2026-73253-mongoose-wildcard-certificate-hostname-verification-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73253 · Severity: info · CVSS 6.5 · Published 2026-08-20

Mongoose is a lightweight embedded web server used in IoT devices, firmware, and networked applications. An attacker on the network path with a wildcard certificate for a parent domain can impersonate subdomains to client applications, allowing interception and modification of TLS-encrypted traffic. This breaks the security guarantee that connections are made to the intended server.

## Quick answers

**Is CVE-2026-73253 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73253 being exploited in the wild.

**How severe is CVE-2026-73253?** Informational severity, with a CVSS score of 6.5, published 20 August 2026.

**Which products and versions are affected?** Cesanta Mongoose before 7.22.

**Is there a fix for CVE-2026-73253?** A patch was published on 2026-06-23: Fix committed to Mongoose master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73253 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-73253?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a hostname verification bypass in Mongoose's built-in TLS stack. The mg_tls_verify_cert_san() and mg_tls_verify_cert_cn() functions in src/tls_builtin.c use mg_match() to validate certificate hostnames, but the wildcard matching is overly permissive—allowing a pattern like *.example.com to incorrectly match foo.bar.example.com (crossing DNS label boundaries). An on-path network attacker with a wildcard certificate for a parent domain can exploit this to perform man-in-the-middle attacks against clients. The vulnerability requires network adjacency and does not require authentication or user interaction. The issue was fixed in version 7.22.

## Affected products

- Cesanta Mongoose before 7.22

## Timeline

- 2026-08-20: disclosed: CVE-2026-73253 published
- 2026-06-23: patched: Fix committed to Mongoose master branch

## References

- [https://github.com/cesanta/mongoose/commit/a9df523f76f43a38bd53b4232b9cfd4c16869e71](https://github.com/cesanta/mongoose/commit/a9df523f76f43a38bd53b4232b9cfd4c16869e71)
- [https://github.com/cesanta/mongoose/pull/3611](https://github.com/cesanta/mongoose/pull/3611)