From 1fb29e7ef51910c23efcec16e6b33cd06e30c9dc Mon Sep 17 00:00:00 2001 From: Kazuki Yamaguchi Date: Sat, 24 Oct 2026 18:11:54 +0900 Subject: [PATCH] ssl: fix NoMethodError on SAN dNSName with an empty label Handle the empty label as a literal string. OpenSSL::SSL::SSLSocket#post_connection_check can raise NoMethodError when the server certificate contains a malformed subjectAltName extension with a dNSName that starts with ".", such as ".example.com". Reported by 4l1ve on HackerOne. --- lib/openssl/ssl.rb | 2 +- test/openssl/test_ssl.rb | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/openssl/ssl.rb b/lib/openssl/ssl.rb index 85a91dee2..b02dee334 100644 --- a/lib/openssl/ssl.rb +++ b/lib/openssl/ssl.rb @@ -335,7 +335,7 @@ def verify_wildcard(domain_component, san_component) # :nodoc: parts = san_component.split("*", -1) return false if parts.size > 2 - return san_component == domain_component if parts.size == 1 + return san_component == domain_component if parts.size <= 1 # RFC 6125, section 6.4.3, subitem 3. # The client SHOULD NOT attempt to match a presented identifier diff --git a/test/openssl/test_ssl.rb b/test/openssl/test_ssl.rb index fa220650b..78b45934a 100644 --- a/test/openssl/test_ssl.rb +++ b/test/openssl/test_ssl.rb @@ -898,6 +898,7 @@ def test_verify_certificate_identity def test_verify_hostname assert_equal(true, OpenSSL::SSL.verify_hostname("www.example.com", "*.example.com")) assert_equal(false, OpenSSL::SSL.verify_hostname("www.subdomain.example.com", "*.example.com")) + assert_equal(false, OpenSSL::SSL.verify_hostname("www.example.com", ".example.com")) end def test_verify_wildcard