Threats affecting pkg:hex/ssl_verify_fun

CVE-2026-117666 is a critical vulnerability in the deadtrickster ssl_verify_fun library affecting versions from 1.0.1 up to but not including 1.1.8. The flaw involves improper validation of TLS certificates with hostnames containing partial-label wildcards, allowing an attacker in a man-in-the-middle position to impersonate a TLS peer by exploiting the wildcard matching logic. This occurs because the wildcard matching function incorrectly allows wildcards to consume dots, violating RFC 6125's restriction that wildcards only apply to the left-most label. The issue affects clients that disable Server Name Indication (SNI), servers verifying client certificate hostnames with this library, and direct calls to verify_cert_hostname/2. Erlang/OTP 20.0 and later mitigate this by checking hostnames before user verification functions if SNI is enabled. The vulnerability is fixed in ssl_verify_fun version 1.1.8.