CVE-2026-45388 Overview
CVE-2026-45388 is an improper certificate validation vulnerability [CWE-295] in the OCaml-TLS library prior to version 2.1.0. The client implementation performs insufficient checks on certificates presented by servers during the TLS handshake. Specifically, the client fails to validate the KeyUsage and ExtendedKeyUsage extensions, which constrain what a certificate may be used for. An attacker who controls a certificate not intended for server authentication can impersonate any TLS server that an OCaml-TLS client connects to. The flaw enables interception and tampering of TLS-protected traffic, undermining the confidentiality and integrity guarantees of the protocol.
Critical Impact
Attackers can impersonate legitimate TLS servers using certificates issued for unrelated purposes, enabling man-in-the-middle attacks against OCaml-TLS clients.
Affected Products
- OCaml-TLS versions prior to 2.1.0
- Applications using OCaml-TLS as a client-side TLS library
- Downstream OCaml ecosystem packages depending on vulnerable OCaml-TLS releases
Discovery Timeline
- 2026-06-15 - CVE-2026-45388 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-45388
Vulnerability Analysis
The vulnerability resides in OCaml-TLS client certificate verification logic. During the TLS handshake, the server presents an X.509 certificate chain that the client must validate before trusting the connection. RFC 5280 defines the KeyUsage extension and the ExtendedKeyUsage (EKU) extension to restrict the cryptographic purposes for which a certificate may be used. For server authentication in TLS, the EKU must include the id-kp-serverAuth object identifier (1.3.6.1.5.5.7.3.1), and the KeyUsage bits must permit digitalSignature or keyEncipherment depending on the negotiated cipher suite.
OCaml-TLS versions before 2.1.0 do not enforce these constraints on the client side. Any certificate that chains to a trusted root is accepted, regardless of its intended purpose. This allows certificates issued for client authentication, code signing, S/MIME, or other purposes to be used to impersonate TLS servers.
Root Cause
The root cause is the omission of KeyUsage and ExtendedKeyUsage validation steps in the client certificate verification pipeline. The library trusts path construction and signature verification but does not enforce purpose-binding semantics on leaf certificates.
Attack Vector
An attacker positioned on the network path between an OCaml-TLS client and its intended server presents a certificate that chains to a trusted certificate authority but was issued for a non-server-authentication purpose. Because the client skips EKU and KeyUsage checks, the handshake completes successfully and the attacker decrypts, inspects, and modifies application traffic.
No verified exploit code is publicly available. See the OSV Vulnerability Report OSEC-2026-06 for further technical details.
Detection Methods for CVE-2026-45388
Indicators of Compromise
- TLS connections from OCaml-TLS clients negotiating with servers presenting certificates whose EKU does not include id-kp-serverAuth.
- Unexpected certificate authorities or leaf certificates appearing in handshake telemetry for known service endpoints.
- Anomalous certificate fingerprints observed in network captures of OCaml application traffic.
Detection Strategies
- Inventory all OCaml applications and dependencies and identify those linked against ocaml-tls below version 2.1.0.
- Inspect network captures with tools such as Wireshark or Zeek to flag TLS sessions where the leaf certificate lacks the server authentication EKU.
- Correlate process execution telemetry with outbound TLS sessions to identify OCaml runtime processes establishing connections to unexpected destinations.
Monitoring Recommendations
- Enable verbose TLS handshake logging in OCaml applications where supported and forward logs to a centralized analytics platform.
- Track certificate transparency logs for unexpected issuance affecting domains accessed by OCaml-TLS clients.
- Alert on TLS handshakes terminating at IP addresses outside approved server ranges for applications using OCaml-TLS.
How to Mitigate CVE-2026-45388
Immediate Actions Required
- Upgrade OCaml-TLS to version 2.1.0 or later across all affected applications and rebuild downstream dependents.
- Audit the OCaml dependency graph using opam list --depends-on tls to identify packages requiring rebuilds.
- Rotate any credentials or session tokens that may have transited through OCaml-TLS clients during the vulnerable period.
Patch Information
The OCaml-TLS maintainers fixed the issue in version 2.1.0 by adding client-side enforcement of KeyUsage and ExtendedKeyUsage extensions during certificate verification. Refer to the OSV Vulnerability Report OSEC-2026-06 for the authoritative fix reference.
Workarounds
- Pin OCaml-TLS clients to communicate only with servers using certificate pinning at the application layer when upgrading is not immediately possible.
- Route OCaml application traffic through a hardened TLS-terminating proxy that performs full certificate purpose validation.
- Restrict outbound network egress from hosts running vulnerable OCaml-TLS clients to a strict allowlist of destinations.
# Upgrade OCaml-TLS via opam
opam update
opam install tls.2.1.0
opam reinstall $(opam list --depends-on tls --short)
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
