Security readout for executives and security teams
Plain-English summary
Mongoose versions before 7.22 may trust a TLS certificate for the wrong hostname. An attacker positioned between a device and server could use a parent-domain wildcard certificate to impersonate a deeper subdomain, exposing or altering encrypted communications.
Executive priority
Treat this as an urgent confidentiality and integrity issue for affected client deployments. Quickly identify pre-7.22 embedded copies and schedule upgrades, prioritizing sensitive communications and devices on untrusted networks. The critical rating warrants prompt action, although exploitation depends on both network position and certificate access.
Technical view
The built-in TLS verifier passes certificate SAN and common-name patterns to mg_match(). Its wildcard matching crosses DNS label boundaries, allowing *.example.com to match foo.bar.example.com. This violates expected hostname validation and enables confidentiality and integrity compromise under the stated on-path and certificate conditions. Version 7.22 fixes the issue.
Likely exposure
Exposure is limited to Mongoose versions earlier than 7.22 using the built-in TLS stack for outbound connections. Risk is greatest where clients connect to deeper subdomains and an attacker could obtain a relevant parent-domain wildcard certificate and intercept network traffic. The sources do not quantify deployment prevalence.
Exploitation context
Exploitation requires an on-path network position and a wildcard certificate for the relevant parent domain. No user interaction or privileges are required. The supplied record does not report active exploitation, and KEV is false. Public proof-of-concept availability is not established by the supplied sources.
Researcher notes
The affected paths are mg_tls_verify_cert_san() and mg_tls_verify_cert_cn() in src/tls_builtin.c. Both relied on mg_match(), whose wildcard semantics could span DNS labels. Review the 7.22 change and regression coverage for SAN and common-name handling. The supplied evidence supports the bypass and fix, but not observed exploitation prevalence.
Mitigation direction
- Upgrade Mongoose to version 7.22 or later.
- Identify statically linked, vendored, or firmware-embedded Mongoose copies that package managers may miss.
- Prioritize internet-facing clients and devices operating across untrusted or interceptable networks.
- Review the vendor advisory before relying on any temporary workaround.
Validation and detection
- Inventory Mongoose versions and confirm whether each deployment uses the built-in TLS stack.
- Check source and binaries for vendored Mongoose releases earlier than 7.22.
- Verify wildcard certificates cannot validate hostnames containing additional DNS labels after upgrading.
- Run existing TLS connection and certificate-validation regression tests against version 7.22.
- Confirm deployed firmware or application artifacts contain the updated library, not only build manifests.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-295: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-73253 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N——GitHub_MVulnerability scoring details
Base CVSS 4.0 score
9.1CriticalVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/cesanta/mongoose/security/advisories/GHSA-jp6g-796f-39vpCVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/cesanta/mongoose/pull/3611CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/cesanta/mongoose/commit/a9df523f76f43a38bd53b4232b9cfd4c16869e71CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/cesanta/mongoose/releases/tag/7.22CVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Certificate Validation
Improper Certificate Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.