CVE-2026-45388: In OCaml-TLS before 2

Synopsis

This is an authentication bypass vulnerability in the OCaml-TLS library affecting its TLS client implementation. The flaw is reachable over the network without any authentication, allowing a network attacker to impersonate a legitimate TLS server by presenting a certificate that lacks the proper KeyUsage or ExtendedKeyUsage extensions for server authentication. Successful exploitation lets an attacker intercept and read encrypted traffic and tamper with data in transit. No upstream fix has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment a fix version is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected service over the network; the component is exposed via standard network connectivity with no physical or local access requirement.

• AuthenticationNot required

  No credentials or account of any kind are needed to attempt exploitation; the vulnerability is exposed to unauthenticated network peers.

• Victim interactionNot required

  No user action such as clicking a link or opening a file is required; exploitation proceeds without any victim participation.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race condition or specific memory layout; an attacker simply presents a mis-typed certificate during the TLS handshake.

Blast Radius

• An attacker impersonates a trusted TLS server, causing the OCaml-TLS client to establish a session with a malicious endpoint it believes to be legitimate.
• All data sent by the client over the spoofed TLS session is readable by the attacker, including credentials, session tokens, and application payloads.
• All data received by the client can be substituted or modified by the attacker, allowing injection of arbitrary application-layer content.