CVE-2026-34871
published 2026-04-01CVE-2026-34871: An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1.1.0. There is a Predictable Seed in a Pseudo-Random Number…
PriorityP429medium6.7CVSS 3.1
AVLACHPRNUINSUCHIHAN
EPSS
0.19%
9.1th percentile
An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1.1.0. There is a Predictable Seed in a Pseudo-Random Number Generator (PRNG).
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| arm | mbed_tls | < 3.6.6 | 3.6.6 |
| debian | mbedtls | — | — |
| trustedfirmware | tf-psa-crypto | < 1.1.0 | 1.1.0 |
CVSS provenance
nvdv3.16.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
osv6.7MEDIUM
vendor_debian6.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2026-34871: mbedtls - An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA...
vendor_debian·2026·CVSS 6.7
CVE-2026-34871 [MEDIUM] CVE-2026-34871: mbedtls - An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA...
An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1.1.0. There is a Predictable Seed in a Pseudo-Random Number Generator (PRNG).
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
OSV
CVE-2026-34871: (An issue was discovered in Mbed TLS before 3
osv·2026-04-02·CVSS 6.7
CVE-2026-34871 [MEDIUM] CVE-2026-34871: (An issue was discovered in Mbed TLS before 3
(An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 ...)
GHSA
GHSA-rjq9-c3rf-c638: An issue was discovered in Mbed TLS before 3
ghsa_unreviewed·2026-04-01
CVE-2026-34871 [MEDIUM] CWE-338 GHSA-rjq9-c3rf-c638: An issue was discovered in Mbed TLS before 3
An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1.1.0. There is a Predictable Seed in a Pseudo-Random Number Generator (PRNG).
OSV
CVE-2026-34871: An issue was discovered in Mbed TLS before 3
osv·2026-04-01·CVSS 6.7
CVE-2026-34871 [MEDIUM] CVE-2026-34871: An issue was discovered in Mbed TLS before 3
An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1.1.0. There is a Predictable Seed in a Pseudo-Random Number Generator (PRNG).
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-34871 dolphin-emu: entropy on Linux can fall back to /dev/urandom [fedora-all]
bugzilla·2026-04-01·CVSS 6.7
CVE-2026-34871 [MEDIUM] CVE-2026-34871 dolphin-emu: entropy on Linux can fall back to /dev/urandom [fedora-all]
CVE-2026-34871 dolphin-emu: entropy on Linux can fall back to /dev/urandom [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-4a6b728056 (dolphin-emu-2503a-16.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-4a6b728056
---
FEDORA-2026-4a6b728056 (dolphin-emu-2503a-16.fc45) has been pushed to the Fedora 45 stable repository.
If problem still persists, please make note of it in this bug report.
Bugzilla
CVE-2026-34871 micropython: entropy on Linux can fall back to /dev/urandom [fedora-all]
bugzilla·2026-04-01·CVSS 6.7
CVE-2026-34871 [MEDIUM] CVE-2026-34871 micropython: entropy on Linux can fall back to /dev/urandom [fedora-all]
CVE-2026-34871 micropython: entropy on Linux can fall back to /dev/urandom [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-d619d8d077 (micropython-1.28.0-1.fc45) has been submitted as an update to Fedora 45.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-d619d8d077
---
FEDORA-2026-52a9a687f0 (micropython-1.28.0-1.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-52a9a687f0
---
FEDORA-2026-d619d8d077 (micropython-1.28.0-1.fc45) has been pushed to the Fedora 45 stable repository.
If problem still persists, please make
Bugzilla
CVE-2026-34871 rust-psa-crypto-sys: entropy on Linux can fall back to /dev/urandom [fedora-all]
bugzilla·2026-04-01·CVSS 6.7
CVE-2026-34871 [MEDIUM] CVE-2026-34871 rust-psa-crypto-sys: entropy on Linux can fall back to /dev/urandom [fedora-all]
CVE-2026-34871 rust-psa-crypto-sys: entropy on Linux can fall back to /dev/urandom [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This package has changed maintainer in Fedora. Reassigning to the new maintainer of this component.
---
This package is not present in any active branch of Fedora.
Bugzilla
CVE-2026-34871 mbedtls: entropy on Linux can fall back to /dev/urandom [fedora-all]
bugzilla·2026-04-01·CVSS 6.7
CVE-2026-34871 [MEDIUM] CVE-2026-34871 mbedtls: entropy on Linux can fall back to /dev/urandom [fedora-all]
CVE-2026-34871 mbedtls: entropy on Linux can fall back to /dev/urandom [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-10443c65e3 (mbedtls-3.6.6-1.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-10443c65e3
---
FEDORA-2026-3a9536df40 (mbedtls-3.6.6-1.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-3a9536df40
---
FEDORA-2026-8c332fbf00 (mbedtls-3.6.6-1.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-8c332fbf00
Bugzilla
CVE-2026-34871 mbedtls: entropy on Linux can fall back to /dev/urandom [epel-all]
bugzilla·2026-04-01·CVSS 6.7
CVE-2026-34871 [MEDIUM] CVE-2026-34871 mbedtls: entropy on Linux can fall back to /dev/urandom [epel-all]
CVE-2026-34871 mbedtls: entropy on Linux can fall back to /dev/urandom [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-EPEL-2026-479c1d4133 (mbedtls-3.6.6-1.el10_1) has been submitted as an update to Fedora EPEL 10.1.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-479c1d4133
---
FEDORA-EPEL-2026-ba79b9dff1 (mbedtls-3.6.6-1.el10_2) has been submitted as an update to Fedora EPEL 10.2.
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-ba79b9dff1
---
FEDORA-EPEL-2026-59a9d512a4 (mbedtls-3.6.6-1.el10_3) has been submitted as an update to Fedora EPEL 10.3.
https://bodhi
Wiz
CVE-2026-34871 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.1
CVE-2026-34871 [MEDIUM] CVE-2026-34871 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-34871 :
Mbed TLS vulnerability analysis and mitigation
An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1.1.0. There is a Predictable Seed in a Pseudo-Random Number Generator (PRNG).
Source : NVD
## 6.7
Score
Published April 1, 2026
Severity MEDIUM
CNA Score 6.7
Affected Technologies
Mbed TLS
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 2.7
Exploitation Probability (EPSS) N/A
Affected packages and libraries
cpe:2.3:a:arm:mbed_tls
mbedtls
Sources
Debian 11, 12, 13, 14 Severity MEDIUM No Fix Added at: Apr 02, 2026
Echo Severity MEDIUM No Fix Added at: Apr 02, 2026
Linux Severity MEDIUM Has Fix Added at: Apr 06, 2026
Li
2026-04-01
Published