EUVD-2026-63500Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because the attacker must be on-path and hold a valid parent-domain wildcard certificate; PR:N/UI:N as no app auth or user action is needed; C:H/I:H for traffic interception and modification, A:N.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mg_tls_verify_cert_san() and mg_tls_verify_cert_cn() functions in src/tls_builtin.c call mg_match(), whose wildcard can cross DNS label boundaries, so a pattern such as *.example.com can match foo.bar.example.com. The resulting hostname verification bypass permits interception and modification of TLS traffic. This issue is fixed in version 7.22.
AnalysisAI
TLS hostname verification bypass in Cesanta Mongoose's built-in TLS stack (versions prior to 7.22) lets an on-path attacker holding a wildcard certificate for a parent domain impersonate arbitrarily deep subdomains, defeating certificate validation for clients that use the embedded TLS backend. The flaw stems from mg_match() wildcards crossing DNS label boundaries, so *.example.com wrongly matches foo.bar.example.com. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concrete conditions: (1) the target must be built with and using Mongoose's built-in TLS stack (src/tls_builtin.c) as a TLS client that performs hostname verification via mg_tls_verify_cert_san()/mg_tls_verify_cert_cn(); (2) the attacker must occupy an on-path/man-in-the-middle network position between client and server (reflected as AT:P in the CVSS 4.0 vector); and (3) the attacker must possess a valid wildcard certificate for a PARENT domain of the target host (e.g., a cert for *.example.com to impersonate foo.bar.example.com). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H, base 9.1) correctly captures both the high confidentiality and integrity impact (traffic interception and modification) and the key precondition: AT:P (Attack Requirements: Present) reflects that the attacker must already be on-path AND possess a valid wildcard certificate for a parent domain - a meaningful barrier not visible in the headline 9.1. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker in an on-path position (e.g., a rogue access point or compromised upstream router) who holds a legitimate wildcard certificate for *.example.com intercepts a Mongoose client's TLS connection to secure.internal.example.com. Mongoose's built-in verifier accepts the wildcard cert even though it should not span the extra label, so the attacker terminates and re-originates the session, reading and altering the traffic transparently. … |
| Remediation | Vendor-released patch: upgrade to Mongoose 7.22 (https://github.com/cesanta/mongoose/releases/tag/7.22), which fixes the label-boundary matching per PR #3611 and commit a9df523f76f43a38bd53b4232b9cfd4c16869e71. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems using Cesanta Mongoose and identify those running versions earlier than 7.22; focus scanning on production and customer-facing deployments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Mongoose ODM for Node.js before version 8.9.5 contains a search injection vulnerability when using $where filters with p
An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6
An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8. Rated crit
An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8.
An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8.
Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4. Rated critical severity (CVSS 9.8), this vu
Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6. Rated critical severity (CVSS 9.8), this vu
An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infin
Mongoose before 8.8.3 can improperly use $where in match, leading to search injection. Rated critical severity (CVSS 9.1
The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 (compiled with OpenSSL support) is vulnerable to remote OO
The mg_tls_init function in Cesanta Mongoose HTTPS server 7.0 and 6.7-6.18 (compiled with mbedTLS support) is vulnerable
The mg_http_serve_file function in Cesanta Mongoose HTTP server 7.0 is vulnerable to remote OOB write attack via connect
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today