EUVD-2026-63494Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUnknown
-
ExploitUnknown
-
ImpactUnknown
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V12 - Secure Communication Certificate validation
|
| Exploitation Conditions | No exploitation conditions can be extracted from the supplied data - the description is a feature label, not a flaw description. No CVSS vector is available to determine attack vector, complexity, or privilege requirements. Authentication requirements not confirmed from available data. |
| Impact | Risk cannot be meaningfully assessed from the available data. CVSS score and vector are both absent, eliminating quantitative metrics for attack vector, complexity, privileges, and impact. EPSS probability is not provided. KEV status is not confirmed. No POC is referenced. The sole intelligence source is a vendor report from Ubuntu, which is insufficient to determine whether this is a network-exploitable validation bypass, a local privilege issue, or a supply-chain concern affecting CA bundles. SSVC decision-making is blocked by the absence of exploitation status, automatable indicator, and technical impact data. This record should not be used to drive prioritization decisions in its current form. |
| Exploit ScenarioDerived | No exploit scenario can be constructed from the available data. The description does not identify the flaw type, attack vector, or required conditions. A scenario would require at minimum knowing whether this is a validation bypass exploitable over the network or a local misconfiguration affecting trust anchors. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 14, 2026
CVE-2026-73251 concerns built-in TLS certificate-chain verification involving CA bundles, reported by Ubuntu. The available intelligence is critically sparse - no description of the actual flaw, no CVSS vector, no CWE classification, and no references have been provided. No meaningful synthesis of attacker capability, affected versions, or exploitability is possible from the supplied data alone. Security teams should treat this record as preliminary pending vendor disclosure.
RemediationAI
No patch version, advisory URL, or workaround information was provided. No vendor-released patch identified at time of analysis. Security teams should monitor Ubuntu Security Notices (USN) and the Ubuntu CVE Tracker for disclosure of this CVE. Until a vendor advisory is published, organizations should not apply speculative mitigations, as the affected component and attack surface are unconfirmed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The description bracket '[Built-in TLS certificate-chain verification with CA bundles]' reads as a feature label rather than a vulnerability description, suggesting this record is incomplete or in a pre-publication state. TLS certificate-chain verification flaws typically fall into categories such as improper certificate validation (CWE-295), insufficient verification of data authenticity (CWE-345), or trust anchor mismanagement - but no CWE has been assigned here. Ubuntu's involvement as reporter suggests the affected component may be a system-level TLS library (e.g., openssl, gnutls, ca-certificates) or a package that bundles its own CA trust store, but no CPE strings are available to confirm the specific component or version.
Know when Mongoose gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (vendor:ubuntu) · only source for this CVE.
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
1DescriptionCVE.org
[Built-in TLS certificate-chain verification with CA bundles]
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Mongoose ODM for Node.js before version 8.9.5 contains a search injection vulnerability when using $where filters with p
An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6
An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8. Rated crit
An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8.
An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8.
Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4. Rated critical severity (CVSS 9.8), this vu
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6. Rated critical severity (CVSS 9.8), this vu
An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infin
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. Rated critical severity (CVSS 9.1
The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 (compiled with OpenSSL support) is vulnerable to remote OO
The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable
The mg_http_serve_file function in Cesanta Mongoose HTTP server 7.0 is vulnerable to remote OOB write attack via connect
Exploit-DB