{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "0"
              },
              {
                "fixed": "7.23"
              }
            ],
            "source": [
              "AFFECTED_FIELD",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2988bc9df3a5efc9539471cb7455975fa25df483"
            },
            {
              "fixed": "02bdbb9ed6f0a8f7c42228c6e7cb35d748b60551"
            }
          ],
          "repo": "https://github.com/cesanta/mongoose",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-qj6j-2692-v2r8"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-295"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73251.json"
  },
  "details": "Mongoose is an embedded web server and network library. Prior to 7.23, a network attacker can impersonate a TLS server to a Mongoose client configured with a multi-certificate CA bundle. In src/tls_builtin.c, the mg_tls_init() function stores the bundle in tls-\u003eca_bundle_der while tls-\u003eca_der.len remains zero, and mg_tls_recv_cert() uses tls_bundle_find() to accept a Common Name match without calling mg_tls_verify_cert_signature(). A forged self-signed certificate can therefore satisfy hostname and CertificateVerify checks and enable interception, credential disclosure, traffic modification, and malicious responses. This issue is fixed in version 7.23.",
  "id": "CVE-2026-73251",
  "modified": "2026-09-11T03:30:14.215033066Z",
  "published": "2026-08-20T17:34:50.472Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cesanta/mongoose/releases/tag/7.23"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73251.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/cesanta/mongoose/security/advisories/GHSA-qj6j-2692-v2r8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73251"
    },
    {
      "type": "FIX",
      "url": "https://github.com/cesanta/mongoose/commit/2988bc9df3a5efc9539471cb7455975fa25df483"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Mongoose Built-in TLS: CA-bundle certificate chain accepted without any signature verification"
}