6 matches found
CVE-2026-117666
Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster sslverifyfun allows an adversary in the middle to impersonate a TLS peer via a certificate that carries a partial-label wildcard. trymatchwildcard/4 in src/sslverifyhostname.erl anchors only the text before and...
CVE-2026-117666
The deadtrickster ssl_verify_fun library (versions 1.0.1 to 1.1.8 ) contains an Improper Validation of Certificate with Host Mismatch vulnerability. The root cause is in the try_match_wildcard/4 function within src/ssl_verify_hostname.erl, which incorrectly anchors text around a wildcard, allowin...
EEF-CVE-2026-117666 ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary
Summary Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster sslverifyfun allows an adversary in the middle to impersonate a TLS peer via a certificate that carries a partial-label wildcard. trymatchwildcard/4 in src/sslverifyhostname.erl anchors only the text befo...
CVE-2026-117666 ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary
Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster sslverifyfun allows an adversary in the middle to impersonate a TLS peer via a certificate that carries a partial-label wildcard. trymatchwildcard/4 in src/sslverifyhostname.erl anchors only the text before and...
EUVD-2026-114450
Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster sslverifyfun allows an adversary in the middle to impersonate a TLS peer via a certificate that carries a partial-label wildcard. trymatchwildcard/4 in src/sslverifyhostname.erl anchors only the text before and...
CVE-2026-117666: deadtrickster ssl_verify_fun: Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster ssl_verify_fun allows an adversary…
Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster sslverifyfun allows an adversary in the middle to impersonate a TLS peer via a certificate that carries a partial-label wildcard. trymatchwildcard/4 in src/sslverifyhostname.erl anchors only the text before and...