Trustedfirmware Mbed Tls vulnerabilities
43 known vulnerabilities affecting trustedfirmware/mbed_tls.
Total CVEs
43
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL11HIGH13MEDIUM16LOW3
Vulnerabilities
Page 3 of 3
CVE-2026-25832P4LOWCVSS 3.7≥ 3.5.0, < 3.6.7≥ 4.0.0, < 4.1.22026-09-14
CVE-2026-25832 [LOW] CWE-669 CVE-2026-25832: In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest
In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group.
nvd
CVE-2025-49087P4LOWCVSS 3.7≥ 3.6.1, < 3.6.42025-07-20
CVE-2025-49087 [LOW] CWE-385 CVE-2025-49087: In Mbed TLS 3.6.1 through 3.6.3 before 3.6.4, a timing discrepancy in block cipher padding removal a
In Mbed TLS 3.6.1 through 3.6.3 before 3.6.4, a timing discrepancy in block cipher padding removal allows an attacker to recover the plaintext when PKCS#7 padding mode is used.
nvd
CVE-2026-73064P4LOWCVSS 2.9≥ 3.2.0, < 3.6.7≥ 4.0.0, < 4.1.12026-09-24
CVE-2026-73064 [LOW] CWE-394 CVE-2026-73064: In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source
In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.
nvd
← Previous3 / 3