CVE-2025-11935
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
With TLS 1.3 pre-shared key (PSK), a malicious or faulty server could ignore the request for PFS (perfect forward secrecy) and the client would continue the connection using PSK without PFS. This occurs when a server responds to a ClientHello containing psk_dhe_ke without a key_share extension, reducing connection security.
Risk Assessment
Re-use of an authenticated PSK connection without PFS on the client side weakens session confidentiality — captured data may be decrypted if the key is later compromised. The risk affects TLS 1.3 clients using PSK.
Recommendation
Update the TLS library to a patched version and consider enforcing PFS in PSK connection configurations. Monitor connections to servers that do not negotiate key_share.
Other vulnerabilities in TLS 1.3
See all- CVE-2026-101302Medium
In TLS 1.3, the actual record type is embedded as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an underflow followed by an unconditional NULL pointer dereference, causing a kernel panic. A remote TLS 1.3 peer can send a specially crafted record to trigger a kernel panic, resulting in a Denial of Service (DoS).
- CVE-2026-32283High
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled resource consumption. This leads to denial of service. This only affects TLS 1.3.
- CVE-2025-12889Medium
With TLS 1.2 connections, a client can use any supported digest, including a weaker one, instead of those specified in the CertificateRequest. This may weaken the security of the connection handshake.
Original NVD description (English source)
With TLS 1.3 pre-shared key (PSK) a malicious or faulty server could ignore the request for PFS (perfect forward secrecy) and the client would continue on with the connection using PSK without PFS. This happened when a server responded to a ClientHello containing psk_dhe_ke without a key_share extension. The re-use of an authenticated PSK connection that on the clients side unexpectedly did not have PFS, reduces the security of the connection.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS