OpenSSL TLS 1.3 Server Vulnerability in Key Exchange Negotiation

CVE-2026-2673

What is CVE-2026-2673?

An defect in the OpenSSL TLS 1.3 server's key exchange negotiation process may lead to the selection of less preferred key exchange groups, impacting secure communications. When configured with the 'DEFAULT' keyword, the server may mishandle the group list, resulting in an inability to negotiate mutually supported post-quantum key agreement groups. This issue arises when clients defer their use of certain keyshares, preventing the correct selection of the most secure group. Users of OpenSSL 3.5 and 3.6 are advised to upgrade to the respective patched versions to mitigate this risk and enhance security.

References