Mongoose EUVD-2026-63500

Exploitation requires three concrete conditions: (1) the target must be built with and using Mongoose's built-in TLS stack (src/tls_builtin.c) as a TLS client that performs hostname verification via mg_tls_verify_cert_san()/mg_tls_verify_cert_cn(); (2) the attacker must occupy an on-path/man-in-the-middle network position between client and server (reflected as AT:P in the CVSS 4.0 vector); and (3) the attacker must possess a valid wildcard certificate for a PARENT domain of the target host (e.g., a cert for *.example.com to impersonate foo.bar.example.com). No authentication to the application is needed (PR:N) and no user interaction is required (UI:N). Limiting factors: deployments using mbedTLS/OpenSSL backends are not affected, and the wildcard-cert-plus-on-path requirement prevents opportunistic remote exploitation.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H, base 9.1) correctly captures both the high confidentiality and integrity impact (traffic interception and modification) and the key precondition: AT:P (Attack Requirements: Present) reflects that the attacker must already be on-path AND possess a valid wildcard certificate for a parent domain - a meaningful barrier not visible in the headline 9.1. There is no EPSS score, KEV listing, or POC in the provided data, so real-world exploitation is currently unproven; this is a capability-gated MitM issue rather than a mass-scannable RCE. Practical risk concentrates in scenarios where an adversary can position on-path (hostile network, compromised router, malicious Wi-Fi) and can obtain or already controls a wildcard cert for the target's parent domain. Note the 9.1 is arguably inflated for typical deployments given the on-path plus wildcard-cert prerequisites - verify applicability against your own network exposure before treating as a drop-everything item.

An attacker in an on-path position (e.g., a rogue access point or compromised upstream router) who holds a legitimate wildcard certificate for *.example.com intercepts a Mongoose client's TLS connection to secure.internal.example.com. Mongoose's built-in verifier accepts the wildcard cert even though it should not span the extra label, so the attacker terminates and re-originates the session, reading and altering the traffic transparently. No public exploit is identified at time of analysis, though the flaw is straightforward to trigger given the prerequisites.