3.7Low
CVE-2026-25832
Description
In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group.
Weakness (CWE):
CWE-669
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| TrustedFirmware | Mbed TLS | 3.5.0 – < 3.6.7, 4.0.0 – < 4.1.2 |