CVE-2026-73064

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-73064

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73064.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-73064

Downstream

Published

2026-09-24T14:58:38Z

Modified

2026-09-26T03:47:17Z

Severity

2.9 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

[none]

Details

In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.

Database specific

{
    "cna_assigner":  "mitre",
    "cwe_ids":  [
        "CWE-394"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73064.json"
}

References

Affected packages

Git / github.com/mbed-tls/mbedtls

Affected ranges

Type

GIT

Repo

https://github.com/mbed-tls/mbedtls

Events

Introduced

3aef7670b78ddebf80f4ad38b9a0059d40021832

Fixed

068ff080b369adfac81509f9b57b2afabaf82dc5

Introduced

ec4044008d2d069da38288bc76b0fee34ec78646

Fixed

0a8fda272a5a0abef3b47c91bed37185d5a726b1

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "3.2.0"
        },
        {
            "fixed":  "3.6.7"
        },
        {
            "introduced":  "4.0.0"
        },
        {
            "fixed":  "4.1.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73064.json"