CVE-2026-73064

2.9 lowEPSS 0.1%

Low (2.9). EPSS 0.1% chance of exploitation in the next 30 days.

In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.

Severity

CVSS 3.1

2.9 low

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.1% chance of exploitation in the next 30 days; higher than 0% of CVEs (scores of 2026-10-31)
CWE: CWE-394
Published: 2026-09-24
Modified: 2026-09-24
Record from: the NVD, synced 2026-10-19

References

https://github.com/Mbed-TLS/mbedtls
https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-random-generator-fault-tls-integrity/

Check your stack JSON