Mongoose, an embedded web server and network library, allows a wildcard certificate for a parent domain to impersonate subdomains of deeper levels because its wildcard matching logic crosses DNS label boundaries. A pattern such as *.example.com can match foo.bar.example.com, bypassing hostname verification. This flaw permits an on‑path attacker to intercept and modify TLS traffic intended for legitimate subdomains, compromising confidentiality and integrity and potentially enabling further exploitation of the client.

The issue affects all cesanta:mongoose versions released before 7.22. Clients and servers that incorporate Mongoose 7.21 or older are vulnerable, while version 7.22 and later include a fix that enforces proper hostname verification.

The CVSS score is 9.1, indicating a high severity flaw. EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an on‑path network attacker who can present a wild‑card certificate for the parent domain; such a scenario is plausible in compromised or controlled network environments. Exploiting the bypass can lead to full TLS traffic interception and modification, potentially exposing sensitive data or facilitating additional attacks against applications using the compromised TLS channel.