CVE-2026-73064: Low severity Mbed TLS Mbed TLS vulnerability
Published Sep 24, 2026
·Updated
In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.
Affected Software
1 affected component
Mbed TLS Mbed TLS>=3.2.0<=3.6.6, >=4.0.0<=4.1.0
Event History
Sep 24, 2026
CVE Published
via MITRE·02:58 PM
Data Sourced
via MITRE·02:58 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
Only TLS 1.3 server deployments are affected. The issue applies to Mbed TLS versions 3.2.0 through 3.6.6 and 4.0.0 through 4.1.0.
2
What must an attacker be able to do to exploit this issue?
The attacker must be able to cause an entropy source failure. Under that condition, they can remove or inject bytes at the start of the TLS stream.