by Kastro
Paper/Archive/CVE-2026-45388

CVE-2026-45388

mitre — In OCaml-TLS before 2.1.0, the client implementation does insufficient checks of the certificate provided by the server, which allows imp…

EPSS 0.2%public exploitCVSS 9.1
critical.is priorityof 100
40
CVSS 9.1 (ADP)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 13.2.132 × 202.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

In OCaml-TLS before 2.1.0, the client implementation does insufficient checks of the certificate provided by the server, which allows impersonation with certificates that are not meant for server authentication (because of KeyUsage and ExtendedKeyUsage).

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitosv.dev/vulnerability/OSEC-2026-06