CVE-2024-28836

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-28836
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-28836.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-28836
Downstream
Published
2024-04-03T00:00:00Z
Modified
2026-07-15T01:49:00.756425756Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When negotiating the TLS version on the server side, it can fall back to the TLS 1.2 implementation of the protocol if it is disabled. If the TLS 1.2 implementation was disabled at build time, a TLS 1.2 client could put a TLS 1.3-only server into an infinite loop processing a TLS 1.2 ClientHello, resulting in a denial of service. If the TLS 1.2 implementation was disabled at runtime, a TLS 1.2 client can successfully establish a TLS 1.2 connection with the server.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28836.json",
    "cna_assigner": "mitre"
}
References

Affected packages

Git / github.com/mbed-tls/mbedtls

Affected ranges

Type
GIT
Repo
https://github.com/mbed-tls/mbedtls
Events
Introduced
1ec69067fa1351427f904362c1221b31538c8b57
Fixed
2ca6c285a0dd3f33982dd57299012dacab1ff206
Database specific 
{
    "extracted_events": [
        {
            "introduced": "3.5.x"
        },
        {
            "fixed": "3.6.0"
        },
        {
            "introduced": "3.5.0"
        }
    ],
    "source": [
        "DESCRIPTION",
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:*"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-28836.json"