CVE-2026-45388

Published: Jun 15, 2026Modified: Jun 17, 2026Deferred

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

In OCaml-TLS before 2.1.0, the client implementation does insufficient checks of the certificate provided by the server, which allows impersonation with certificates that are not meant for server authentication (because of KeyUsage and ExtendedKeyUsage).

Related CWEs

CWE-295

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (2)

https://osv.dev/vulnerability/OSEC-2026-06

Source: cve@mitre.org

https://osv.dev/vulnerability/OSEC-2026-06

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.