TLS Impersonation Vulnerability in Mongoose Web Server by Cesanta

CVE-2026-73251

What is CVE-2026-73251?

Mongoose, an embedded web server and network library, is susceptible to a vulnerability that allows network attackers to impersonate a TLS server. This issue arises when a Mongoose client, configured with a multi-certificate CA bundle, encounters a forged self-signed certificate. The flaw in the mg_tls_init() function fails to correctly handle the CA bundle, leading to insufficient verification during the mg_tls_recv_cert() process. As a result, attackers can bypass standard hostname and CertificateVerify checks, enabling them to intercept traffic, disclose sensitive credentials, modify data, and deliver harmful responses. Fortunately, this vulnerability has been addressed in version 7.23.

References