PT-2026-26321 · Wolfssl · Wolfssl

Kai Tian · Published 2026-03-19 · Updated 2026-05-01 · CVE-2026-2645

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions wolfSSL versions prior to 5.8.4

Description A flaw existed in the TLS 1.2 server state machine implementation where the server could incorrectly accept the CertificateVerify message before the ClientKeyExchange message was received. This issue affects versions prior to 5.8.4. Version 5.8.4 detects the issue later in the handshake, and 5.9.0 further hardens the process to catch the issue earlier.

Recommendations Update to wolfSSL version 5.8.4 or later.

Fix

Improperly Implemented Security Check for Standard

Weakness Enumeration

CWE-358

Related Identifiers

CVE-2026-2645

Affected Products

Wolfssl

References · 12

• https://github.com/wolfSSL/wolfssl/pull/9694 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-2645 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-2645 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-2645 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-2645 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-2645 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2645 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-2645 · Vendor Advisory
• https://twitter.com/DFIR_Lab/status/2050006606096572684 · Twitter Post
• https://twitter.com/VulnersHub/status/2036710487187140904 · Twitter Post
• https://twitter.com/CVEnew/status/2036024193549259133 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034728937947898192 · Twitter Post