PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45389 OCaml CVE debrief

A vulnerability was discovered in OCaml-TLS before version 2.1.0. The server implementation performs insufficient checks on the certificate provided by the client during client authentication. This flaw allows for impersonation using certificates that are not intended for client authentication, due to improper validation of KeyUsage and ExtendedKeyUsage.

Vendor
OCaml
Product
OCaml-TLS
CVSS
HIGH 7.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-15
Original CVE updated
2026-06-17
Advisory published
2026-06-15
Advisory updated
2026-06-17

Who should care

Users of OCaml-TLS before version 2.1.0, especially those who rely on client authentication in their TLS connections, should be aware of this vulnerability.

Technical summary

The vulnerability exists in the server implementation of OCaml-TLS before 2.1.0. During client authentication, the server does not properly check the client's certificate, specifically regarding its KeyUsage and ExtendedKeyUsage. This oversight enables an attacker to impersonate clients using certificates not meant for client authentication.

Defensive priority

High

Recommended defensive actions

  • Update to OCaml-TLS version 2.1.0 or later.
  • Review and adjust client authentication configurations to ensure proper certificate validation.
  • Consider implementing additional security measures, such as certificate pinning or stricter certificate validation rules.

Evidence notes

The CVE record indicates that the vulnerability was published and modified on June 15, 2026. The source item URL suggests that this information comes from the NVD database.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45389 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45389

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45389 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45389

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.