CVE-2026-73253 cesanta CVE debrief

Who should care

Network defenders and system administrators responsible for TLS-enabled services using Mongoose should assess their inventory for potential exposure and prioritize upgrading to version 7.22 or later.

Why it matters

CVE-2026-73253 is a critical vulnerability in Mongoose that allows an on-path network attacker to impersonate deeper subdomains to a client using the built-in TLS stack. Defenders should prioritize verifying exposure and upgrading to version 7.22 or later.

• Potential interception of TLS traffic
• Possible modification of TLS traffic
• Verification of Mongoose version and exposure
• Upgrade to version 7.22 or later

Technical summary

The mg_tls_verify_cert_san() and mg_tls_verify_cert_cn() functions in src/tls_builtin.c call mg_match(), whose wildcard can cross DNS label boundaries, allowing a pattern such as *.example.com to match foo.bar.example.com. This results in a hostname verification bypass, permitting interception and modification of TLS traffic. The vulnerability is caused by the improper handling of wildcard certificates in the TLS stack. The affected product is Mongoose, and the issue is fixed in version 7.22. Defenders should prioritize verifying exposure of Mongoose versions prior to 7.22 and upgrading to 7.22 or later.

Defensive priority

Defenders should prioritize verifying exposure of Mongoose versions prior to 7.22 and upgrading to 7.22 or later. Network defenders and system administrators responsible for TLS-enabled services should assess their inventory for potential exposure.

Recommended defensive actions

• Verify Mongoose version and upgrade to 7.22 or later if necessary
• Assess inventory for potential exposure
• Monitor for suspicious TLS activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the corpus does not establish specific exploitation instances or business impacts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.