CVE-2026-2645

In wolfSSL 5.8.2 and earlier, a logic flaw existed in the TLS 1.2 server state machine implementation. The server could incorrectly accept the CertificateVerify message before the ClientKeyExchange message had been received. This issue affects wolfSSL before 5.8.4 (wolfSSL 5.8.2 and earlier is vulnerable, 5.8.4 is not vulnerable). In 5.8.4 wolfSSL would detect the issue later in the handshake. 5.9.0 was further hardened to catch the issue earlier in the handshake.

• CWE-358

• https://github.com/wolfSSL/wolfssl/pull/9694Issue Tracking, Patch

Published

Mar 19, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-2644A weakness has been identified in niklasso minisat up to 2.2…7.8
• CVE-2026-26445stomper 5e2741e is vulnerable to Denial of Service. A malici…7.5
• CVE-2026-26446Stomper 5e2741e is vulnerable to Denial of Service. When a b…7.5
• CVE-2026-26447Stomper 5e2741e is vulnerable to Use-After-Free. When a sing…7.5
• CVE-2026-26448Stomper 5e2741e is vulnerable to Use-After-Free. When a clie…9.8
• CVE-2026-26449In Stomper 5e2741e when a client sends a SEND frame missing …7.5
• CVE-2026-26452ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 lcontains a v…7.5
• CVE-2026-26453ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a nu…7.5
• CVE-2026-26456A null pointer dereference vulnerability exists in the serve…7.5
• CVE-2026-26457ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a nu…7.5
• CVE-2026-26459ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5 contains a vu…7.5
• CVE-2026-2646A heap-buffer-overflow vulnerability exists in wolfSSL's wol…8.1