CVE-2026-11703

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An issue exists where SNI (Server Name Indication) and ALPN (Application-Layer Protocol Negotiation) bindings are missing during stateful session-ID resumption. This allows a cached session to be resumed using a different SNI or ALPN than what was originally negotiated. In environments where client-authentication policies vary across virtual hosts, this could allow a cached peer-authentication state to be applied to a context for which it was not intended.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.