IT SBIT Services
Schneeberger
DEEN
CVE tracker

ssl_verify_fun: Partial-label wildcard certificate accepted across label boundary

CVE-2026-117666Critical 9.1

← All vulnerabilities

Summary

The Erlang library ssl_verify_fun accepts certificates with a partial-label wildcard such as f*.example.net, so the wildcard also matches hostnames spanning several labels, for example f.evil.example.net. It also lets *.168.1.1 match the IP address 192.168.1.1. An attacker in a man-in-the-middle position who holds such a certificate from a trusted CA could impersonate the affected host and read or alter the connection. Clients that keep server_name_indication set are protected by the hostname check in Erlang/OTP, but clients with SNI disabled, servers verifying client certificates with this library and direct callers of verify_cert_hostname/2 are exposed.

Affected

  • ssl_verify_fun from 1.0.1 before 1.1.8 (Hex)
  • Git revisions a49ca56923356c7a3981692b23c42ef32c2990e0 to before ca34031299cd2e0c98794c0da4ba556b94e39aad
  • Erlang/OTP older than 20.0 is also exposed

Fixed in

  • Upgrade to ssl_verify_fun 1.1.8 or later

Workaround

  • Keep server_name_indication set to the target hostname and add {customize_hostname_check, [{match_fun, public_key:pkix_verify_hostname_match_fun(https)}]} to the ssl options (Erlang/OTP 21 or later). This does not cover clients with SNI disabled, server-side client certificate checks or direct calls to verify_cert_hostname/2.

Exploitation

  • No public proof-of-concept or exploitation known.
  • Attack requires a man-in-the-middle position and a partial-label wildcard certificate from a CA the client trusts, which the CA/Browser Forum Baseline Requirements do not allow, so the realistic exposure is private PKI.
  • Not listed in CISA KEV as far as known; not checked directly.

Our recommendation

  • Check lock files (mix.lock, rebar.lock) and software inventories for ssl_verify_fun versions 1.0.1 to 1.1.7.
  • Upgrade to 1.1.8 or later where found and verify the version on Hex before pinning.
  • Prioritise services that disable SNI or verify client certificates with this library.
  • Apply the interim configuration workaround where an upgrade cannot be done immediately.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 05:05.

Original description (NVD)

Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster ssl_verify_fun allows an adversary in the middle to impersonate a TLS peer via a certificate that carries a partial-label wildcard. try_match_wildcard/4 in src/ssl_verify_hostname.erl anchors only the text before and after the * of an identifier such as f*.example.net, so the wildcard also consumes dots and the certificate is accepted for f.evil.example.net. RFC 6125 confines a wildcard to the left-most label. The same matcher lets *.168.1.1 match the IP literal 192.168.1.1. Whole-label wildcards are matched correctly. Erlang/OTP 20.0 and later check the hostname in ssl before a user verify_fun sees valid_peer, so a client that keeps server_name_indication set rejects the mismatch regardless. Exposed are clients that disable SNI, servers that verify client certificate hostnames with this library, and direct callers of verify_cert_hostname/2. This issue affects ssl_verify_fun: from 1.0.1 before 1.1.8.

NVD references (6)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed