Executive brief
OCaml-TLS is a library used by applications to establish secure, encrypted connections. A flaw in its TLS 1.3 implementation fails to verify if a server's security certificate is actually authorized for use by a server. This allows an attacker who possesses a valid certificate intended for other purposes (like email signing or employee identification) to impersonate a legitimate website or service, potentially leading to the theft of sensitive data or credentials.
Technical details
A vulnerability exists in the OCaml-TLS 1.3 client implementation where it fails to validate the KeyUsage and ExtendedKeyUsage (EKU) extensions of a server's leaf certificate. While the library correctly performs these checks for TLS 1.2, the TLS 1.3 entry point in 'handshake_client13.ml' was not wired to the validation logic. An attacker with a certificate issued by a trusted CA for non-server purposes (such as clientAuth, codeSigning, or emailProtection) can impersonate a target host if they can redirect the victim's network traffic. This bypasses the security boundaries defined in RFC 5280 and RFC 8446. The issue is resolved in version 2.1.0.
Affected products
- OCaml-TLS tls < 2.1.0
Timeline
- 2026-04-18: other: Vulnerability discovered
- 2026-04-30: other: Reported to OCaml security team
- 2026-05-20: patched: Version 2.1.0 released
- 2026-05-20: advisory: Security advisory published
- 2026-06-15: disclosed: CVE published to NVD