CVE-2026-117666 in Ssl Verify Fun
Summary
by MITRE • 10/30/2026
Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster ssl_verify_fun allows an adversary in the middle to impersonate a TLS peer via a certificate that carries a partial-label wildcard. try_match_wildcard/4 in src/ssl_verify_hostname.erl anchors only the text before and after the * of an identifier such as f*.example.net, so the wildcard also consumes dots and the certificate is accepted for f.evil.example.net. RFC 6125 confines a wildcard to the left-most label. The same matcher lets *.168.1.1 match the IP literal 192.168.1.1. Whole-label wildcards are matched correctly.
Erlang/OTP 20.0 and later check the hostname in ssl before a user verify_fun sees valid_peer, so a client that keeps server_name_indication set rejects the mismatch regardless. Exposed are clients that disable SNI, servers that verify client certificate hostnames with this library, and direct callers of verify_cert_hostname/2.
This issue affects ssl_verify_fun: from 1.0.1 before 1.1.8.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in the ssl_verify_fun library for Erlang/OTP represents a critical flaw in hostname validation logic, specifically within the try_match_wildcard function found in src/ssl_verify_hostname.erl. This implementation fails to strictly adhere to RFC 6125 requirements regarding wildcard certificates. The core technical defect lies in how the matcher processes identifiers containing wildcards. Instead of restricting the wildcard character to match only a single label, as mandated by industry standards which confine wildcards to the left-most label and prohibit them from consuming dots or multiple labels, this implementation allows the wildcard to span across dot separators. Consequently, a certificate with a common name such as f*.example.net is erroneously accepted for hostnames like f.evil.example.net. This behavior effectively neutralizes the security boundary intended by wildcard certificates, allowing an adversary positioned in the middle of a communication channel to impersonate a TLS peer using a maliciously crafted certificate that exploits this permissive matching logic.
Beyond domain name mismatches, the vulnerability extends to IP address literals, presenting another significant attack vector. The same flawed matcher permits patterns like *.168.1.1 to match the specific IP literal 192.168.1.1. This improper validation of certificate with host mismatch undermines the fundamental trust model of Transport Layer Security by allowing certificates intended for a range or subset of addresses to be accepted for unrelated or maliciously spoofed endpoints. While whole-label wildcards are matched correctly, the inconsistency in handling partial labels and IP literals creates an unpredictable security posture where certain configurations remain vulnerable while others do not, complicating defense-in-depth strategies that rely on consistent validation behavior across different endpoint types.
The operational impact of this vulnerability is contingent upon how clients configure their Secure SNI settings within Erlang/OTP versions 20.0 and later. In these versions, the ssl module performs hostname checking before invoking a user-defined verify_fun callback with valid_peer status. Therefore, clients that maintain server_name_indication enabled will reject mismatches at this earlier stage, mitigating the risk for standard HTTPS client implementations that rely on default behaviors. However, significant exposure remains for specific use cases. Clients that explicitly disable SNI are directly exposed to impersonation attacks because they bypass the initial hostname check layer. Furthermore, servers utilizing ssl_verify_fun to verify client certificate hostnames during mutual TLS authentication are vulnerable if they do not enforce strict hostname matching. Direct callers of the verify_cert_hostname/2 function also face risk as they may invoke this flawed validation logic without additional safeguards.
This vulnerability is classified under CWE-295 Improper Certificate Validation and aligns with MITRE ATT&CK techniques related to Man-in-the-Middle attacks, specifically those involving certificate spoofing or misuse of valid certificates for unauthorized access. The flaw allows attackers to bypass identity verification mechanisms that are designed to prevent such impersonation. To mitigate this risk, organizations must ensure they upgrade ssl_verify_fun to version 1.1.8 or later, where the hostname matching logic has been corrected to strictly follow RFC standards. For environments unable to immediately patch, administrators should enforce strict SNI usage in client configurations and avoid disabling server_name_indication unless absolutely necessary for legacy compatibility. Additionally, custom verify_fun implementations should incorporate additional validation layers that explicitly check for wildcard scope compliance before accepting a certificate as valid peer credentials.