CVE-2026-73253

Mongoose is an embedded web server and network library.

Mongoose

Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mg_tls_verify_cert_san() and mg_tls_verify_cert_cn() functions in src/tls_builtin.c call mg_match(), whose wildcard can cross DNS label boundaries, so a pattern such as *.example.com can match foo.bar.example.com. The resulting hostname…

20. Aug 2026

Ausgewertete Quellen

• NVD
  CVE-2026-73253
• GitHub
  https://github.com/cesanta/mongoose/security/advisories/GHSA-jp6g-796f-39vp