What is CVE-2026-2673?

CVE-2026-2673 is a medium-severity vulnerability in Openssl, classified under CWE-757. CVSS score: 6.5/10. Published 2026-03-13.

How severe is CVE-2026-2673?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Openssl

CVE-2026-2673

Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key e…

EPSS: 0.000 (6.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L.

Affected products

Weakness classification (CWE)

CWE-757

References

openssl-security@openssl.org (vendor-advisory, Vendor Advisory)
openssl-security@openssl.org (Patch, patch)
openssl-security@openssl.org (Patch, patch)
af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)
0b142b55-0307-4c5a-b3c9-f314f3fb7c5e (Third Party Advisory)

Frequently asked questions

What is CVE-2026-2673?: CVE-2026-2673 is a medium-severity vulnerability in Openssl, classified under CWE-757. CVSS score: 6.5/10. Published 2026-03-13.
How severe is CVE-2026-2673?: Medium severity. CVSS v3 base score is 6.5 out of 10.