CVE-2026-45388
Critical · 9.1CVSS
9.1
EPSS
0.3%
Published
Jun 15, 2026
CISA due date
—
The record
In OCaml-TLS before 2.1.0, the client implementation does insufficient checks of the certificate provided by the server, which allows impersonation with certificates that are not meant for server authentication (because of KeyUsage and ExtendedKeyUsage).
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| opam | tls | 0 | 2.1.0 |
Related vulnerabilities
- OSEC-2026-06 TLS-client (with TLS 1.3) does insufficient certificate checks (missing KeyUsage and… Same vulnerability
- CVE-2026-45389 In OCaml-TLS before 2.1.0, the server implementation does insufficient checks of the… Also affects tls
- OSEC-2026-07 TLS-server does insufficient client certificate checks (missing KeyUsage and… Also affects tls
- CVE-2026-96375 Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the… CWE-295
- CVE-2026-87944 Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider… CWE-295
- CVE-2026-114642 Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend… CWE-295
- CVE-2026-114406 The system certificate authority (CA) store in Red Hat products, distributed via… CWE-295
- CVE-2026-95210 Improper certificate validation in gnutls v3.8.13 causes the application to accept… CWE-295