ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary
Affects ssl_verify_fun 1.0.1 before 1.1.8 in clients with server_name_indication disabled, servers verifying client certificates with it, or Erlang/OTP before 20.0. Fixed in 1.1.8.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 1.1.8
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The ssl_verify_fun Erlang library (versions before 1.1.8) is affected: its hostname matching lets a wildcard certificate such as f*.example.net match hostnames that cross a label boundary, and it can match IP addresses. An attacker positioned between a client and server could present such a certificate to impersonate the TLS peer, though clients using Erlang/OTP 20.0 or later with SNI enabled are protected by the built-in hostname check.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster ssl_verify_fun allows an adversary in the middle to impersonate a TLS peer via a certificate that carries a partial-label wildcard. try_match_wildcard/4 in src/ssl_verify_hostname.erl anchors only the text before and after the * of an identifier such as f*.example.net, so the wildcard also consumes dots and the certificate is accepted for f.evil.example.net. RFC 6125 confines a wildcard to the left-most label. The same matcher lets *.168.1.1 match the IP literal 192.168.1.1. Whole-label wildcards are matched correctly. Erlang/OTP 20.0 and later check the hostname in ssl before a user verify_fun sees valid_peer, so a client that keeps server_name_indication set rejects the mismatch regardless. Exposed are clients that disable SNI, servers that verify client certificate hostnames with this library, and direct callers of verify_cert_hostname/2. This issue affects ssl_verify_fun: from 1.0.1 before 1.1.8.
Timeline
- CVE published
- First seen by cve.now
- Posted on X by cve.now
Affected versions
- ssl_verify_fun
From 1.0.1 · fixed in 1.1.8
- deadtrickster/ssl_verify_fun.erl
Version range not reported
References 6
GitHub · deadtrickster/ssl_verify_fun.erl
cna.erlef.org
Questions about CVE-2026-117666
What does this mean?
A holder of a certificate for a partial-label wildcard such as f*.example.net, issued by a CA the client trusts, can impersonate hosts like f.<label>.example.net across a label boundary. A client that relies on ssl_verify_fun alone for hostname verification can then have the traffic of that connection read or altered.Source: github.com
Am I affected, and how do I check?
Versions from 1.0.1 before 1.1.8 are affected, in clients with server_name_indication disabled, TLS servers that use ssl_verify_hostname:verify_fun/3 to verify client certificates, code calling verify_cert_hostname/2 directly, or Erlang/OTP older than 20.0. Check the ssl_verify_fun version in the dependency lock file, the server_name_indication setting, and the Erlang/OTP version.Source: github.com
What should I do about it?
Upgrade ssl_verify_fun to 1.1.8. If upgrading is not possible on Erlang/OTP 21 or later, keep server_name_indication set to the target hostname and pass {customize_hostname_check, [{match_fun, public_key:pkix_verify_hostname_match_fun(https)}]} in the ssl options.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data