OSEC-2026-06
High · 7.4CVSS
7.4
EPSS
—
Published
May 20, 2026
CISA due date
—
The record
TLS-client (with TLS 1.3) does insufficient certificate checks (missing KeyUsage and ExtendedKeyUsage validation)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| opam | tls | 0 | 2.1.0 |
Related vulnerabilities
- CVE-2026-45388 In OCaml-TLS before 2.1.0, the client implementation does insufficient checks of the… Same vulnerability
- CVE-2026-45389 In OCaml-TLS before 2.1.0, the server implementation does insufficient checks of the… Also affects tls
- OSEC-2026-07 TLS-server does insufficient client certificate checks (missing KeyUsage and… Also affects tls