A low-severity vulnerability exists in Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, where the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group. This issue has a CVSS score of 3.7. The vulnerability may allow for information disclosure. Defenders should verify configurations and consider updates to mitigate potential risks. Verification of Mbed TLS versions and configurations [truncated]
CVE-2026-34874 is a HIGH severity vulnerability in Mbed TLS, a cryptographic library developed by Trustedfirmware. The vulnerability, discovered through [source-item], allows an attacker to write to address 0 via distinguished name parsing, potentially leading to a crash or other unspecified impact. The vulnerability has a CVSS score of 7.5 and is classified as CWE-476: NULL Pointer Dereference.
CVE-2026-25834 is a vulnerability in Mbed TLS, a cryptographic library developed by Trustedfirmware. The vulnerability, with a CVSS score of 6.5 and a severity of MEDIUM, allows for Algorithm Downgrade attacks. This type of attack can occur when a vulnerable system accepts a weaker cryptographic algorithm than it is capable of supporting, potentially leading to a compromise of the system's security. The v [truncated]
