CVE-2026-2673

/// Technical description

Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected

preferred key exchange group when its key exchange group configuration includes

the default by using the 'DEFAULT' keyword.

Impact summary: A less preferred key exchange may be used even when a more

preferred group is supported by both client and server, if the group

was not included among the client's initial predicated keyshares.

This will sometimes be the case with the new hybrid post-quantum groups,

if the client chooses to defer their use until specifically requested by

the server.

If an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to

interpolate the built-in default group list into its own configuration, perhaps

adding or removing specific elements, then an implementation defect causes the

'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups

were treated as a single sufficiently secure 'tuple', with the server not

sending a Hello Retry Request (HRR) even whe

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References