CVE-2026-73253 is a wildcard certificate verification bypass in Mongoose's TLS hostname validation. The function mg_tls_verify_cert_san() delegates hostname matching to mg_match() in string.c, which implements wildcard patterns that violate RFC 6125. Specifically, the pattern *.example.com will match foo.bar.example.com — crossing DNS label boundaries when the standard requires wildcards to match only a single label.
This matters because you're likely consuming Mongoose as an embedded library and calling mg_tls_verify_cert_san() without any visibility into how it validates hostnames. The function name mg_match() suggests general-purpose pattern matching, not security-critical certificate validation. That's the trap: the abstraction implies "we handle TLS securely," while the underlying mechanism fails on multi-level subdomains common in cloud-native and containerized deployments.
The bug isn't a configuration error you made — it's a semantic gap between what the interface promises and what the matching logic delivers. The wildcard matching likely worked fine for simple cases (*.example.com → foo.example.com) and was never tested against the edge case of label-boundary traversal because the API doesn't signal this as a testing requirement.
What to check: if you deploy Mongoose versions before 7.22 and use TLS with wildcard certificates across multi-level subdomains, verify whether your certificates are being validated correctly. The fix in 7.22 should enforce single-label wildcard matching, but audit your deployment to confirm the update has propagated — particularly if you're embedded in IoT or automotive contexts where patch adoption lags.
The deeper pattern: library code handling security-critical logic with semantics misaligned from standards creates invisible trust gaps. This isn't unique to Mongoose. The same wildcard boundary-crossing bug appeared in nginx (CVE-2012-5823) and Ruby Net::HTTP (CVE-2013-4073). The lesson isn't "read the source" — it's that security guarantees must be enforced at abstraction boundaries, not silently delegated to utility functions whose names invite loose interpretation.