CVE-2026-73251
Received Received - Intake

Mongoose TLS Server Impersonation via Certificate Spoofing

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
Mongoose is an embedded web server and network library. Prior to 7.23, a network attacker can impersonate a TLS server to a Mongoose client configured with a multi-certificate CA bundle. In src/tls_builtin.c, the mg_tls_init() function stores the bundle in tls->ca_bundle_der while tls->ca_der.len remains zero, and mg_tls_recv_cert() uses tls_bundle_find() to accept a Common Name match without calling mg_tls_verify_cert_signature(). A forged self-signed certificate can therefore satisfy hostname and CertificateVerify checks and enable interception, credential disclosure, traffic modification, and malicious responses. This issue is fixed in version 7.23.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-73251
EUVD
EUVD-2026-63494

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
mongoose mongoose to 7.23 (exc)
cesanta mongoose to 7.23 (exc)
cesanta mongoose 7.23

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Mongoose library's TLS implementation allows a network attacker to impersonate a TLS server to a client using a multi-certificate CA bundle. The issue occurs because the certificate validation relies on Common Name matching without verifying cryptographic signatures, enabling man-in-the-middle attacks.

Detection Guidance

To detect this vulnerability, check if your system is running Mongoose versions prior to 7.23. Use commands like 'mongoose --version' or inspect package managers for installed versions. Monitor network traffic for unexpected TLS handshake anomalies or MITM patterns.

Impact Analysis

An attacker could intercept, modify, or steal sensitive data like credentials, tokens, or firmware updates. They could also serve malicious responses to the client, compromising the integrity and confidentiality of communications.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties and reputational damage.

Mitigation Strategies

Upgrade Mongoose to version 7.23 or later immediately. If upgrading is not possible, disable TLS connections or restrict network access to trusted sources. Review CA bundles for improper configurations and ensure proper certificate chain validation is enforced.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73251. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart