CVE-2026-45389
Critical · 9.1CVSS
9.1
EPSS
0.2%
Published
Jun 15, 2026
CISA due date
—
The record
In OCaml-TLS before 2.1.0, the server implementation does insufficient checks of the certificate provided by the client (when doing client authentication), which allows impersonation with certificates that are not meant for client authentication (because of KeyUsage and ExtendedKeyUsage).
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| opam | tls | 0 | 2.1.0 |
Related vulnerabilities
- OSEC-2026-07 TLS-server does insufficient client certificate checks (missing KeyUsage and… Same vulnerability
- CVE-2026-45388 In OCaml-TLS before 2.1.0, the client implementation does insufficient checks of the… Also affects tls
- OSEC-2026-06 TLS-client (with TLS 1.3) does insufficient certificate checks (missing KeyUsage and… Also affects tls