CVE-2026-25832
LowCVSS 3.7Summary
In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts a HelloRetryRequest selecting a group that was not advertised. This can violate TLS 1.3 protocol negotiation expectations.
Risk Assessment
Accepting an unadvertised cryptographic group may allow an attacker to manipulate TLS handshake negotiation and weaken session security. Organizations using Mbed TLS in TLS 1.3 client applications are exposed.
Recommendation
Upgrade Mbed TLS to version 3.6.7 or 4.1.2 (or later) to remediate the vulnerability. Identify which applications use this library and plan patch deployment.
Other vulnerabilities in Mbed TLS
See all- CVE-2026-34877Critical
A vulnerability in Mbed TLS (versions 2.19.0 to 3.6.5 and 4.0.0) is caused by insufficient protection of serialized SSL structures. An attacker can modify these structures, leading to memory corruption and potential arbitrary code execution.
- CVE-2026-34876High
Mbed TLS 3.x before 3.6.6 has an out-of-bounds read vulnerability in mbedtls_ccm_finish() due to missing validation of the tag_len parameter. An attacker can obtain adjacent CCM context data.
Original NVD description (English source)
In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group.