CVE-2026-2645 Acceptance of CertificateVerify Message before ClientKeyExchange in TLS 1.2

What is CVE-2026-2645?

CVE-2026-2645 is a medium-severity vulnerability in Wolfssl Wolfssl, published on 19 Mar 2026.

Official description

In wolfSSL 5.8.2 and earlier, a logic flaw existed in the TLS 1.2 server state machine implementation. The server could incorrectly accept the CertificateVerify message before the ClientKeyExchange message had been received. This issue affects wolfSSL before 5.8.4 (wolfSSL 5.8.2 and earlier is vulnerable, 5.8.4 is not vulnerable). In 5.8.4 wolfSSL would detect the issue later in the handshake. 5.9.0 was further hardened to catch the issue earlier in the handshake.

Weakness: CWE-358

Which versions are affected by CVE-2026-2645?

It affects 1 product.

Products include Wolfssl Wolfssl.

How do I fix CVE-2026-2645?

Upgrade to a fixed version.

Is CVE-2026-2645 being exploited?

There is no known exploitation of CVE-2026-2645 in the wild and no public exploit code.

Other vulnerabilities in Wolfssl Wolfssl

• CVE-2024-5991 Buffer overread in domain name matching Critical 10.0
• CVE-2021-37155 Security feature bypass in n/a Critical 9.8
• CVE-2020-36177 Memory corruption in n/a Critical 9.8
• CVE-2014-2896 Memory corruption in n/a Critical 9.8
• CVE-2014-2897 Memory corruption in n/a Critical 9.8

All Wolfssl Wolfssl vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-2645, GHSA-cwc7-2fmx-fffq, JLSEC-2026-701, UBUNTU-CVE-2026-2645.