# CVE-2023-28321: IDN wildcard match

curl's private wildcard cert matcher accepted partial patterns like x* against punycode IDN hosts, allowing hostname mismatch acceptance.

- Payout: hidden
- Severity: low
- Program: Internet Bug Bounty
- Found by: kurohiro
- Disclosed: 2023-06-25
- CVE: CVE-2023-28321
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1991427
- Library page: https://bugbountylibrary.com/r/h1%3A1991427
- Tags: area:devices domain:network impact:integrity kind:bounty platform:hackerone sev:low tech:curl vuln:crypto vuln:misconfiguration

**Target:** TLS server certificate hostname matching (Subject Alternative Name wildcard)
**Root cause:** curl's own wildcard matching function allowed partial wildcard patterns (e.g. x*) and applied them to punycode IDN names starting with xn--, which should never pattern-match.
**Steps:**
1. Build curl with its internal name matching (not TLS library's).
2. Present a TLS cert whose SAN wildcard pattern like `x*` matches a punycode IDN host `xn--...`.
3. curl accepts the mismatched certificate as valid for the host.
**Insight:** When a project reimplements hostname/cert matching instead of delegating to the TLS library, test wildcard semantics against punycode IDN names (xn--) where partial patterns like x* can spuriously match.