Improper validation of certificates with host mismatches allows an adversary in the middle to impersonate a TLS peer using a certificate with a partial-label wildcard. The `try match wildcard/4` function in `src/ssl verify hostname.erl` only anchors text before and after the asterisk in identifiers like `f*.example.net`, allowing the wildcard to consume dots and accept certificates for unauthorized domains such as `f.evil.example.net`. This contradicts RFC 6125, which restricts wildcards to the left-most label. Additionally, the matcher allows `*.168.1.1` to match the IP literal `192.168.1.1`. This issue affects clients that disable Server Name Indication (SNI), servers verifying client certificate hostnames, and direct callers of the `verify cert hostname/2` function.