CVE-2026-2645

published 2026-03-19

CVE-2026-2645: In wolfSSL 5.8.2 and earlier, a logic flaw existed in the TLS 1.2 server state machine implementation. The server could incorrectly accept the…

Priority P3 42 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I H A N

In wolfSSL 5.8.2 and earlier, a logic flaw existed in the TLS 1.2 server state machine implementation. The server could incorrectly accept the CertificateVerify message before the ClientKeyExchange message had been received. This issue affects wolfSSL before 5.8.4 (wolfSSL 5.8.2 and earlier is vulnerable, 5.8.4 is not vulnerable). In 5.8.4 wolfSSL would detect the issue later in the handshake. 5.9.0 was further hardened to catch the issue earlier in the handshake.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
debian	wolfssl	< wolfssl 5.9.0-0.1 (forky)	wolfssl 5.9.0-0.1 (forky)
msrc	azl3_mariadb_10.11.16-1_on_azure_linux_3.0	—	—
msrc	cbl2_mariadb_10.6.24-1_on_cbl_mariner_2.0	—	—
wolfssl	wolfssl	< 5.8.4	5.8.4
wolfssl	wolfssl	>= 0 < 5.9.0-0.1	5.9.0-0.1

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

nvd v4.0 5.5 MEDIUM CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_msrc 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-358