Description (CNA)
In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| trustedfirmware / Mbed TLS | affected 3.2.0 before 3.6.7; affected 4.0.0 before 4.1.1 |
CWE
CWE-394
References
- https://github.com/Mbed-TLS/mbedtls
- https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-random-generator-fault-tls-integrity/
ADP enrichment
No English description supplied.
No references supplied.