CVE-2026-73251 is a critical vulnerability in the cesanta mongoose library affecting versions prior to 7.23. The flaw arises from improper certificate validation in the TLS implementation. Specifically, in src/tls_builtin.c, the mg_tls_init() function stores the CA bundle incorrectly, leaving tls->ca_der.len at zero. Consequently, mg_tls_recv_cert() uses tls_bundle_find() to accept a Common Name match without verifying the certificate signature via mg_tls_verify_cert_signature(). This allows a network attacker to present a forged self-signed certificate that satisfies hostname and CertificateVerify checks, enabling man-in-the-middle attacks such as interception, credential disclosure, traffic modification, and malicious responses. The vulnerability is addressed in mongoose version 7.23.

An attacker on the network can impersonate a TLS server to a vulnerable Mongoose client configured with a multi-certificate CA bundle. This impersonation can lead to interception of sensitive data, disclosure of credentials, modification of network traffic, and delivery of malicious responses. The vulnerability undermines the trust model of TLS connections by allowing acceptance of forged self-signed certificates without proper signature verification.

This vulnerability is fixed in mongoose version 7.23. Users should upgrade to version 7.23 or later to remediate the issue. No official patch or temporary workaround is documented in the provided data. Patch status is not yet confirmed beyond the stated fix version—check the vendor advisory for current remediation guidance.