GHSA-jp6g-796f-39vp: Mongoose: TLS Hostname Verification Bypass via Overly Permissive Wildcard Matching

Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mgtlsverifycertsan() and mgtlsverifycertcn() functions in src/tlsbuiltin.c call mgmatch(), whose wildcard can cross DNS label boundaries, so a pattern such as .example.com can match foo.bar.example.com. The resulting hostname verification bypass permits interception and modification of TLS traffic. This issue is fixed in version 7.22.