Improper Certificate Validation in deadtrickster's SSL Verification Library

CVE-2026-117666

What is CVE-2026-117666?

The improper validation of hostnames using partial-label wildcard certificates poses a significant risk in deadtrickster's ssl_verify_fun library. The vulnerability allows adversaries to conduct man-in-the-middle attacks by exploiting a flaw in the matching algorithm, which incorrectly permits wildcard matches that cross label boundaries. For example, a certificate for f*.example.net may be accepted for f.evil.example.net, undermining the security intended by RFC 6125. This affects clients that disable Server Name Indication (SNI) and servers verifying client certificates without adequate safeguards.

References