CVE-2026-73064

Published: Sep 24, 2026Modified: Sep 24, 2026

2.9

Vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 1.4 / Impact: 1.4

Source: MITRE (Secondary)

Description

In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.

Related CWEs

CWE-394

Unexpected Status Code or Return Value

The product does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the product.

References (2)

https://github.com/Mbed-TLS/mbedtls

Source: cve@mitre.org

https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-random-generator-fault-tls-integrity/

Source: cve@mitre.org

Timeline

No history available yet.