CVE-2026-117666
Description
A flaw was found in ssl_verify_fun. The library improperly validates Transport Layer Security (TLS) certificates containing partial wildcards, allowing wildcard patterns to match across domain label boundaries and IP addresses. A man-in-the-middle attacker can exploit this vulnerability by presenting a crafted certificate for an unauthorized domain. Successful exploitation allows the attacker to impersonate a legitimate peer and intercept or tamper with encrypted communications.
Statement
A flaw was found in the ssl_verify_fun library's try_match_wildcard/4 function within src/ssl_verify_hostname.erl. The wildcard matching logic improperly anchors only characters immediately before and after the asterisk, allowing wildcards to span domain label boundaries (dot characters) and match arbitrary IP literals. An attacker in an on-path / man-in-the-middle network position can exploit this behavior by presenting a certificate with a partial-label wildcard to bypass hostname verification and impersonate a legitimate TLS peer.
Mitigation
Ensure Server Name Indication (SNI) remains enabled on TLS clients running Erlang/OTP 20.0 or later so built-in OTP hostname checks reject mismatches prior to ssl_verify_fun evaluation. Avoid issuing or accepting certificates with partial-label wildcards, and do not invoke verify_cert_hostname/2 directly on untrusted inputs without prior label boundary sanitization.
Understanding the Weakness (CWE)
Integrity,Authentication
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
