Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In wolfSSL 5.8.2 and earlier, a logic flaw existed in the TLS 1.2 server state machine implementation. The server could incorrectly accept the CertificateVerify message before the ClientKeyExchange message had been received. This issue affects wolfSSL before 5.8.4 (wolfSSL 5.8.2 and earlier is vulnerable, 5.8.4 is not vulnerable). In 5.8.4 wolfSSL would detect the issue later in the handshake. 5.9.0 was further hardened to catch the issue earlier in the handshake.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-19 | 1 | Disclosure1 |
| 2026-03-23 | 1 | Disclosure1 |
| 2026-03-25 | 1 | Disclosure1 |
| 2026-05-01 | 1 | Patch1 |
🚨 HIGH: CVE-2026-2645 (CVSS 7.5) wolfSSL ≤5.8.2 TLS 1.2 state machine flaw allows incorrect handshake message acceptance. Upgrade to 5.8.4+ immediately. Impact: Integrity compromise #CVE #Vulnerability #PatchNow #ThreatIntel https://t.co/vgJtR7TIj2
Post summary
The tweet announces a state machine flaw in wolfSSL affecting TLS 1.2 and urges users to upgrade to version 5.8.4 or newer as the primary mitigation.
CVE-2026-2645 Acceptance of CertificateVerify Message before ClientKeyExchange in TLS 1.2 http://dlvr.it/TRh8tn
Post summary
The snippet announces CVE-2026-2645, describing a TLS 1.2 message ordering flaw, with no mention of PoC, exploit, patch, or active exploitation.
CVE-2026-2645 In wolfSSL 5.8.2 and earlier, a logic flaw existed in the TLS 1.2 server state machine implementation. The server could incorrectly accept the CertificateVerify message… https://www.cve.org/CVERecord?id=CVE-2026-2645
Post summary
The advisory reports a logic flaw in wolfSSL 5.8.2 and earlier that can allow the server to misaccept a CertificateVerify message, with no patches, exploits, or active exploitation referenced.
CVE-2026-2645 TLS 1.2 Server State Machine Logic Flaw in wolfSSL Before 5.8.4 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-2645
Post summary
The text announces a new TLS 1.2 state machine logic flaw in wolfSSL prior to version 5.8.4, without details on PoC, exploits, or mitigations.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wolfssl | wolfssl | - | - | - |