CVE-2026-45389

OCaml-TLS prior to 2.1.0 suffers insufficient client-certificate validation in mTLS: the server does not enforce KeyUsage (digitalSignature) or EKU (clientAuth) on client certs, allowing impersonation with certificates meant for server authentication. Affected component is the server-side handsha...