Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-117666— ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary

Quick assessment

Affected
deadtrickster ssl_verify_fun
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

中存在“证书主机名不匹配验证不当”的漏洞，使得中间人攻击者能够利用包含部分标签通配符（partial-label wildcard）的证书来伪装成 TLS 对等方。在 中的 函数仅对标识符（如 ）中星号（ ）前后的文本进行锚定，导致通配符也能匹配点号（ ），从而使得证书被错误地接受用于 。根据 RFC 6125 的规定，通配符应仅限于最左侧的标签。此外，相同的匹配逻辑还允许 匹配 IP 字面量 。而整标签通配符（whole-label wildcards）的匹配则是正确的。 在 Erlang/OTP 20.0 及更

CVSS 9.1 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-117666

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary
Source: CVE Program / CVE List V5
Vulnerability Description
Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster ssl_verify_fun allows an adversary in the middle to impersonate a TLS peer via a certificate that carries a partial-label wildcard. try_match_wildcard/4 in src/ssl_verify_hostname.erl anchors only the text before and after the * of an identifier such as f*.example.net, so the wildcard also consumes dots and the certificate is accepted for f.evil.example.net. RFC 6125 confines a wildcard to the left-most label. The same matcher lets *.168.1.1 match the IP literal 192.168.1.1. Whole-label wildcards are matched correctly. Erlang/OTP 20.0 and later check the hostname in ssl before a user verify_fun sees valid_peer, so a client that keeps server_name_indication set rejects the mismatch regardless. Exposed are clients that disable SNI, servers that verify client certificate hostnames with this library, and direct callers of verify_cert_hostname/2. This issue affects ssl_verify_fun: from 1.0.1 before 1.1.8.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对宿主不匹配的证书验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
deadtrickster ssl_verify_fun 1.0.1 ~ 1.1.8 cpe:2.3:a:deadtrickster:ssl_verify_fun:*:*:*:*:*:*:*:*
deadtrickster ssl_verify_fun a49ca56923356c7a3981692b23c42ef32c2990e0 ~ ca34031299cd2e0c98794c0da4ba556b94e39aad cpe:2.3:a:deadtrickster:ssl_verify_fun:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-117666

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-117666

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-117666 (3)

Vendor Advisories for CVE-2026-117666 (2)

Other References for CVE-2026-117666 (1)

IV. Related Vulnerabilities

Same weakness: CWE-297