CVE-2026-117666

Name of the Vulnerable Software and Affected Versions deadtrickster ssl verify fun versions 1.0.1 through 1.1.7

Description Improper validation of certificates with host mismatches allows an adversary in the middle to impersonate a TLS peer using a certificate with a partial-label wildcard. The try match wildcard/4 function in src/ssl verify hostname.erl only anchors text before and after the asterisk in identifiers like f*.example.net, allowing the wildcard to consume dots and accept certificates for unauthorized domains such as f.evil.example.net. This contradicts RFC 6125, which restricts wildcards to the left-most label. Additionally, the matcher allows *.168.1.1 to match the IP literal 192.168.1.1. This issue affects clients that disable Server Name Indication (SNI), servers verifying client certificate hostnames, and direct callers of the verify cert hostname/2 function.

Recommendations Update deadtrickster ssl verify fun to version 1.1.8.