CVE-2026-73253

Katalog CVE

CVSS 9.1 · Critical EPSS 0,34%

Kerentanan Improper Certificate Validation pada cesanta mongoose. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mg_tls_verify_cert_san() and mg_tls_verify_cert_cn() functions in src/tls_builtin.c call mg_match(), whose wildcard can cross DNS label boundaries, so a pattern such as *.example.com can match foo.bar.example.com. The resulting hostname verification bypass permits interception and modification of TLS traffic. This issue is fixed in version 7.22.

Rincian

Terbit di NVD

20 Agustus 2026

Terakhir diubah

29 September 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-295: Improper Certificate Validation

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 26,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/cesanta/mongoose/security/advisories/GHSA-jp6g-796f-39vp exploit · advisory vendor
• https://github.com/cesanta/mongoose/commit/a9df523f76f43a38bd53b4232b9cfd4c16869e71 patch
• https://github.com/cesanta/mongoose/pull/3611 issue tracking · patch
• https://github.com/cesanta/mongoose/releases/tag/7.22 release notes