CVE-2026-25832

3.7 lowEPSS 0.3%

Low (3.7). EPSS 0.3% chance of exploitation in the next 30 days.

In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group.

Severity

3.7 low

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 20% of CVEs (scores of 2026-10-31)
CWE: CWE-669
Published: 2026-09-14
Modified: 2026-09-22
Record from: the NVD, synced 2026-10-19