CVE-2026-117666 ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary
- Published
- Updated
- Exploit status
- No public exploit known
Description
Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster ssl_verify_fun allows an adversary in the middle to impersonate a TLS peer via a certificate that carries a partial-label wildcard. try_match_wildcard/4 in src/ssl_verify_hostname.erl anchors only the text before and after the * of an identifier such as f*.example.net, so the wildcard also consumes dots and the certificate is accepted for f.evil.example.net. RFC 6125 confines a wildcard to the left-most label. The same matcher lets *.168.1.1 match the IP literal 192.168.1.1. Whole-label wildcards are matched correctly.
Erlang/OTP 20.0 and later check the hostname in ssl before a user verify_fun sees valid_peer, so a client that keeps server_name_indication set rejects the mismatch regardless. Exposed are clients that disable SNI, servers that verify client certificate hostnames with this library, and direct callers of verify_cert_hostname/2.
This issue affects ssl_verify_fun: from 1.0.1 before 1.1.8.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| deadtrickster ssl verify fun | >= 1.0.1, < 1.1.8 | 1.1.8 |
| deadtrickster ssl verify fun | >= a49ca56923356c7a3981692b23c42ef32c2990e0, < ca34031299cd2e0c98794c0da4ba556b94e39aad | ca34031299cd2e0c98794c0da4ba556b94e39aad |
| debian/rebar3(Debian:12) | All versions | No fix listed |
| debian/rebar3(Debian:12) | = 3.19.0-1 | No fix listed |
| debian/rebar3(Debian:12) | = 3.23.0-1 | No fix listed |
| debian/rebar3(Debian:12) | = 3.23.0-2 | No fix listed |
| debian/rebar3(Debian:12) | = 3.23.0-3 | No fix listed |
| debian/rebar3(Debian:12) | = 3.24.0-1 | No fix listed |
| debian/rebar3(Debian:12) | = 3.25.1-1 | No fix listed |
| debian/rebar3(Debian:12) | = 3.26.0-1 | No fix listed |
| debian/rebar3(Debian:12) | = 3.27.0-1 | No fix listed |
| debian/rebar3(Debian:12) | = 3.27.0-2 | No fix listed |
| debian/rebar3(Debian:12) | = 3.27.0-3 | No fix listed |
| debian/rebar3(Debian:12) | = 3.27.0-4 | No fix listed |
| debian/rebar3(Debian:12) | = 3.27.0-5 | No fix listed |
| debian/rebar3(Debian:12) | = 3.27.0-6 | No fix listed |
| debian/rebar3(Debian:12) | = 3.27.3-1 | No fix listed |
| debian/rebar3(Debian:12) | = 3.28.0-1 | No fix listed |
| debian/rebar3(Debian:13) | All versions | No fix listed |
| debian/rebar3(Debian:13) | = 3.24.0-1 | No fix listed |
| debian/rebar3(Debian:13) | = 3.25.1-1 | No fix listed |
| debian/rebar3(Debian:13) | = 3.26.0-1 | No fix listed |
| debian/rebar3(Debian:13) | = 3.27.0-1 | No fix listed |
| debian/rebar3(Debian:13) | = 3.27.0-2 | No fix listed |
| debian/rebar3(Debian:13) | = 3.27.0-3 | No fix listed |
Show 17 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/rebar3(Debian:13) | = 3.27.0-4 | No fix listed |
| debian/rebar3(Debian:13) | = 3.27.0-5 | No fix listed |
| debian/rebar3(Debian:13) | = 3.27.0-6 | No fix listed |
| debian/rebar3(Debian:13) | = 3.27.3-1 | No fix listed |
| debian/rebar3(Debian:13) | = 3.28.0-1 | No fix listed |
| debian/rebar3(Debian:14) | All versions | No fix listed |
| debian/rebar3(Debian:14) | = 3.24.0-1 | No fix listed |
| debian/rebar3(Debian:14) | = 3.25.1-1 | No fix listed |
| debian/rebar3(Debian:14) | = 3.26.0-1 | No fix listed |
| debian/rebar3(Debian:14) | = 3.27.0-1 | No fix listed |
| debian/rebar3(Debian:14) | = 3.27.0-2 | No fix listed |
| debian/rebar3(Debian:14) | = 3.27.0-3 | No fix listed |
| debian/rebar3(Debian:14) | = 3.27.0-4 | No fix listed |
| debian/rebar3(Debian:14) | = 3.27.0-5 | No fix listed |
| debian/rebar3(Debian:14) | = 3.27.0-6 | No fix listed |
| debian/rebar3(Debian:14) | = 3.27.3-1 | No fix listed |
| debian/rebar3(Debian:14) | = 3.28.0-1 | No fix listed |
References
- ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary related vendor-advisory
- EEF CNA record for CVE-2026-117666 related
- OSV record EEF-CVE-2026-117666 related
- Do not let partial-label wildcards match across label boundaries (ssl_verify_fun.erl pull request #33) patch
- Introducing commit a49ca56 in deadtrickster/ssl_verify_fun.erl related
- Fix commit ca34031 in deadtrickster/ssl_verify_fun.erl patch
- Red Hat CVE page mitigation vendor-advisory
- Red Hat Bugzilla 2564302 issue-tracking
- www.cve.org
- nvd.nist.gov
- Debian Security Tracker CVE-2026-117666 vendor-advisory
- bugs.debian.org issue-tracking