{"id":"CVE-2026-73064","state":"PUBLISHED","title":"In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only a","description":"In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.","publishedAt":"2026-09-24T14:58:38.367Z","updatedAt":"2026-09-24T18:00:20.196Z","severity":{"score":2.9,"label":"Low","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","source":"mitre"},"assigner":"mitre","products":["trustedfirmware Mbed TLS"],"affected":[{"vendor":"trustedfirmware","product":"Mbed TLS","defaultStatus":"unaffected","versions":[{"version":"3.2.0","status":"affected","lessThan":"3.6.7","versionType":"semver"},{"version":"4.0.0","status":"affected","lessThan":"4.1.1","versionType":"semver"}],"repo":"https://github.com/Mbed-TLS/mbedtls"}],"references":["https://github.com/Mbed-TLS/mbedtls","https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-random-generator-fault-tls-integrity/"],"weaknesses":["CWE-394"],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/73xxx/CVE-2026-73064.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-73064","state":"PUBLISHED","datePublished":"2026-09-24T14:58:38.367Z","dateUpdated":"2026-09-24T18:00:20.196Z","assignerShortName":"mitre","assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","dateReserved":"2026-08-10T19:25:32.256Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers."}],"affected":[{"vendor":"trustedfirmware","product":"Mbed TLS","defaultStatus":"unaffected","versions":[{"version":"3.2.0","status":"affected","lessThan":"3.6.7","versionType":"semver"},{"version":"4.0.0","status":"affected","lessThan":"4.1.1","versionType":"semver"}],"repo":"https://github.com/Mbed-TLS/mbedtls"}],"references":[{"url":"https://github.com/Mbed-TLS/mbedtls"},{"url":"https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-random-generator-fault-tls-integrity/"}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":2.9,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-394","description":"CWE-394 Unexpected Status Code or Return Value","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"mitre","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","dateUpdated":"2026-09-24T14:58:38.367Z"},"x_generator":{"engine":"CVE-Request-form 0.0.1"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-24T18:00:13.513498Z","id":"CVE-2026-73064","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-24T18:00:20.196Z"}}]}}}