CVE-2026-73253 is a critical (CVSS 9.1) hostname verification flaw in the Mongoose embedded library's built-in TLS. A wildcard pattern such as *.example.com can match deeper names, so an on-path attacker with a parent domain wildcard certificate can impersonate subdomains. Fixed in Mongoose 7.22.
What's affected
Mongoose before 7.22, fixed in 7.22, per the NVD record and the project's release. The affected code is in src/tls_builtin.c, in the functions mg_tls_verify_cert_san and mg_tls_verify_cert_cn, which call the general purpose mg_match matcher.
The flaw applies to clients using the built-in TLS stack. The attacker needs to be on the network path and to hold a valid wildcard certificate for a parent domain. That is a real constraint on who can use the flaw.
The same library has a second TLS flaw in this period, CVE-2026-73251, fixed in 7.23. Moving to 7.23 or later covers both.
How to check if you're exposed
Find the version in your source tree.
grep MG_VERSION mongoose.h
Then confirm whether your code uses the built-in TLS for client connections. If you link an external TLS library instead, the vulnerable functions are not in use.
What to do now
- Update Mongoose to 7.23 or later, which includes the 7.22 fix and the fix for CVE-2026-73251.
- Rebuild and redeploy firmware or applications that embed it.
- Review which hostnames your clients connect to and which certificates they present, especially wildcards on parent domains.
- Consider pinning the certificate or public key for connections to your own services.
- Record Mongoose in your inventory with its version.
Why it matters
The record maps this to CWE-295, improper certificate validation. Wildcard certificates are meant to cover a single label, so *.example.com matches www.example.com but not a.b.example.com. The matcher Mongoose used for names treats a wildcard as matching across label boundaries, which makes the certificate cover more names than the issuer intended.
Hostname checks are one of two halves of server authentication, the other being the chain of trust. Getting either one wrong lets a certificate for one name stand in for another. Small embedded libraries often write their own matcher, which is where this class of mistake shows up.
The record's KEV flag is false.
Quick check
Is a wildcard certificate required for the attack?
Yes. The record describes an attacker holding a wildcard certificate for a parent domain who is on the network path.
Sources
Last reviewed: 19 October 2026.
