PT-2026-26321 · Wolfssl · Wolfssl

Kai Tian · Publicado 2026-03-19 · Atualizado 2026-05-01 · CVE-2026-2645

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions wolfSSL versions prior to 5.8.4

Description A flaw existed in the TLS 1.2 server state machine implementation where the server could incorrectly accept the CertificateVerify message before the ClientKeyExchange message was received. This issue affects versions prior to 5.8.4. Version 5.8.4 detects the issue later in the handshake, and 5.9.0 further hardens the process to catch the issue earlier.

Recommendations Update to wolfSSL version 5.8.4 or later.

Correção

Improperly Implemented Security Check for Standard

Enumeração de Fraquezas

CWE-358

Identificadores relacionados

CVE-2026-2645

Produtos afetados

Wolfssl

Referências · 12

• https://github.com/wolfSSL/wolfssl/pull/9694 · Correção
• https://twitter.com/DFIR_Lab/status/2050006606096572684 · Publicação no Twitter
• https://security-tracker.debian.org/tracker/CVE-2026-2645 · Aviso do Fabricante
• https://twitter.com/VulnersHub/status/2036710487187140904 · Publicação no Twitter
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-2645 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-2645 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2036024193549259133 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2034728937947898192 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-2645 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2026-2645 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-2645 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-2645 · Aviso do Fabricante