CVE-2026-117666

The record

Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster ssl_verify_fun allows an adversary in the middle to impersonate a TLS peer via a certificate that carries a partial-label wildcard. try_match_wildcard/4 in src/ssl_verify_hostname.erl anchors only the text before and after the * of an identifier such as f*.example.net, so the wildcard also consumes dots and the certificate is accepted for f.evil.example.net. RFC 6125 confines a wildcard to the left-most label. The same matcher lets *.168.1.1 match the IP literal 192.168.1.1. Whole-label wildcards are matched correctly. Erlang/OTP 20.0 and later check the hostname in ssl before a user verify_fun sees valid_peer, so a client that keeps server_name_indication set rejects the mismatch regardless. Exposed are clients that disable SNI, servers that verify client certificate hostnames with this library, and direct callers of verify_cert_hostname/2. This issue affects ssl_verify_fun: from 1.0.1 before 1.1.8.

Affected packages

Related vulnerabilities

• CVE-2026-66392 Apache bRPC versions before 1.18.0 validate the server certificate chain when client TLS… CWE-297
• CVE-2026-86410 A flaw in the curl command line tool's logic makes it only set SSH host verification… CWE-297
• CVE-2026-88647 A hostname verification bypass in GnuTLS v3.8.13 allows attackers to circumvent the… CWE-297
• CVE-2026-107660 FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation… CWE-297
• CVE-2026-19553 ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if… CWE-297
• CVE-2026-91769 PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries… CWE-297
• CVE-2026-63374 AnyIO is a high level asynchronous concurrency and networking framework that works on top… CWE-297
• CVE-2026-79636 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-297