CVE-2026-2645
High · 7.5CVSS
7.5
EPSS
0.2%
Published
Mar 19, 2026
CISA due date
—
The record
In wolfSSL 5.8.2 and earlier, a logic flaw existed in the TLS 1.2 server state machine implementation. The server could incorrectly accept the CertificateVerify message before the ClientKeyExchange message had been received. This issue affects wolfSSL before 5.8.4 (wolfSSL 5.8.2 and earlier is vulnerable, 5.8.4 is not vulnerable). In 5.8.4 wolfSSL would detect the issue later in the handshake. 5.9.0 was further hardened to catch the issue earlier in the handshake.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-46582 In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as… CWE-358
- CVE-2026-49783 Improperly implemented security check for standard in Windows Secure Boot allows an… CWE-358
- CVE-2026-11122 Inappropriate implementation in Keyboard in Google Chrome prior to 149.0.7827.53 allowed… CWE-358
- CVE-2026-11127 Inappropriate implementation in WebAPKs in Google Chrome on Android prior to… CWE-358
- CVE-2026-44475 Ella Core is a 5G core designed for private networks. CWE-358
- CVE-2026-44473 Ella Core is a 5G core designed for private networks. CWE-358
- CVE-2026-44474 Ella Core is a 5G core designed for private networks. CWE-358
- CVE-2026-42082 free5GC is an open-source implementation of the 5G core network. CWE-358