CVE-2026-117666

Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster sslverifyfun allows an adversary in the middle to impersonate a TLS peer via a certificate that carries a partial-label wildcard. trymatchwildcard/4 in src/sslverifyhostname.erl anchors only the text before and...

CVE-2026-117666 ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary

Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster sslverifyfun allows an adversary in the middle to impersonate a TLS peer via a certificate that carries a partial-label wildcard. trymatchwildcard/4 in src/sslverifyhostname.erl anchors only the text before and...

CVE-2026-117666

The deadtrickster ssl_verify_fun library (versions 1.0.1 to 1.1.8 ) contains an Improper Validation of Certificate with Host Mismatch vulnerability. The root cause is in the try_match_wildcard/4 function within src/ssl_verify_hostname.erl, which incorrectly anchors text around a wildcard, allowin...

EUVD-2026-114450

Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster sslverifyfun allows an adversary in the middle to impersonate a TLS peer via a certificate that carries a partial-label wildcard. trymatchwildcard/4 in src/sslverifyhostname.erl anchors only the text before and...

CVE-2026-117666: deadtrickster ssl_verify_fun: Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster ssl_verify_fun allows an adversary…

Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster sslverifyfun allows an adversary in the middle to impersonate a TLS peer via a certificate that carries a partial-label wildcard. trymatchwildcard/4 in src/sslverifyhostname.erl anchors only the text before and...