CVE-2026-73253

CVE-2026-73253 is a wildcard certificate verification bypass in Mongoose's TLS hostname validation. The function `mg_tls_verify_cert_san()` delegates hostname matching to `mg_match()` in `string.c`, which implements wildcard patterns that violate RFC 6125. Specifically, the pattern `*.example.com` will match `foo.bar.example.com` — crossing DNS label boundaries when the standard requires wildcards to match only a single label. This matters because you're likely consuming Mongoose as an embedded library and calling `mg_tls_verify_cert_san()` without any visibility into how it validates hostnames. The function name `mg_match()` suggests general-purpose pattern matching, not security-critical certificate validation. That's the trap: the abstraction implies "we handle TLS securely," while the underlying mechanism fails on multi-level subdomains common in cloud-native and containerized deployments. The bug isn't a configuration error you made — it's a semantic gap between what the interface promises and what the matching logic delivers. The wildcard matching likely worked fine for simple cases (`*.example.com` → `foo.example.com`) and was never tested against the edge case of label-boundary traversal because the API doesn't signal this as a testing requirement. What to check: if you deploy Mongoose versions before 7.22 and use TLS with wildcard certificates across multi-level subdomains, verify whether your certificates are being validated correctly. The fix in 7.22 should enforce single-label wildcard matching, but audit your deployment to confirm the update has propagated — particularly if you're embedded in IoT or automotive contexts where patch adoption lags. The deeper pattern: library code handling security-critical logic with semantics misaligned from standards creates invisible trust gaps. This isn't unique to Mongoose. The same wildcard boundary-crossing bug appeared in nginx (CVE-2012-5823) and Ruby Net::HTTP (CVE-2013-4073). The lesson isn't "read the source" — it's that security guarantees must be enforced at abstraction boundaries, not silently delegated to utility functions whose names invite loose interpretation.

Reviewed through automated stages and approved by a human before publication.