CVE-2026-34871
An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1...
CVE-2026-34871 is a medium vulnerability (CVSS 6.7) in Arm Mbed Tls, published April 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. Fixed in mbedtls 3.6.6-0.1.
An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1.1.0. There is a Predictable Seed in a Pseudo-Random Number Generator (PRNG).
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1.1.0. There is a Predictable Seed in a Pseudo-Random Number Generator (PRNG).
- Record
CVE-2026-34871- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-338
- Updated
- 2026-11-02
EUVDEUVD-2026-18001
An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1.1.0. There is a Predictable Seed in a Pseudo-Random Number Generator (PRNG).
- Record
EUVD-2026-18001- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rjq9-c3rf-c638
An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1...
An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1.1.0. There is a Predictable Seed in a Pseudo-Random Number Generator (PRNG).
- Record
GHSA-rjq9-c3rf-c638- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-338
- Updated
- 2026-11-02
NVD
An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1.1.0. There is a Predictable Seed in a Pseudo-Random Number Generator (PRNG).
- Record
CVE-2026-34871- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-338
- Updated
- 2026-11-02
OSV
An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1.1.0. There is a Predictable Seed in a Pseudo-Random Number Generator (PRNG).
- Record
CVE-2026-34871- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-34871
An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1.1.0. There is a Predictable Seed in a Pseudo-Random Number Generator (PRNG).
- Record
DEBIAN-CVE-2026-34871- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVJLSEC-2026-465
Mbed TLS may use a low entropy PRNG seed
An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1.1.0. There is a Predictable Seed in a Pseudo-Random Number Generator (PRNG).
- Record
JLSEC-2026-465- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-34871
An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1.1.0. There is a Predictable Seed in a Pseudo-Random Number Generator (PRNG).
- Record
UBUNTU-CVE-2026-34871- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10498-1 No score
libeverest-3.6.6-1.1 on GA media
These are all security issues fixed in the libeverest-3.6.6-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10498-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mbedtlsDebian:12 |
All versions, plus listed versions 2.28.3-12.28.4-12.28.5-12.28.6-12.28.7-1 Show 18 moreShow less2.28.7-1.12.28.7-1.1~exp12.28.8-13.6.0-13.6.0-23.6.0-33.6.2-13.6.2-23.6.2-33.6.3-13.6.4-13.6.4-23.6.5-0.13.6.5-0.1~deb13u13.6.6-0.13.6.6-0.1~deb13u13.6.7-23.6.7-3 |
None known |
mbedtlsDebian:13 |
All versions, plus listed versions 3.6.4-23.6.5-0.13.6.5-0.1~deb13u13.6.6-0.13.6.6-0.1~deb13u13.6.7-23.6.7-3 |
None known |
mbedtlsDebian:14 |
before 3.6.6-0.1, plus listed versions 3.6.4-23.6.5-0.13.6.5-0.1~deb13u13.6.6-0.1~deb13u1 |
3.6.6-0.1 |
MbedTLS_jllJulia |
All versions | None known |
mbedtlsUbuntu:16.04:LTS |
All versions, plus listed versions 2.1.2-12.2.0-12.2.1-12.2.1-22.2.1-2ubuntu0.12.2.1-2ubuntu0.22.2.1-2ubuntu0.3 |
None known |
mbedtlsUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.5.1-1ubuntu12.6.0-12.7.0-22.8.0-12.8.0-1ubuntu0.1~esm1 |
None known |
mbedtlsUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.16.2-12.16.3-12.16.4-1ubuntu22.16.4-1ubuntu2+esm1 |
None known |
mbedtlsUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2.16.9-0.1ubuntu12.16.11-0.1ubuntu12.16.11-0.32.28.0-12.28.0-1build12.28.0-1ubuntu0.1~esm1 |
None known |
mbedtlsUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 2.28.3-12.28.6-1ubuntu12.28.7-1ubuntu12.28.7-1.1ubuntu12.28.8-12.28.8-1ubuntu0.1~esm1 |
None known |
mbedtlsUbuntu:25.10 |
All versions, plus listed versions 3.6.2-3ubuntu1 |
None known |
mbedtlsUbuntu:26.10 |
All versions, plus listed versions 3.6.5-0.1ubuntu23.6.6-0.1ubuntu13.6.7-3ubuntu1 |
None known |
mbedtlsUbuntu:26.04:LTS |
All versions, plus listed versions 3.6.2-3ubuntu13.6.5-0.1ubuntu13.6.5-0.1ubuntu2 |
None known |
mbedtlsopenSUSE:Tumbleweed |
before 3.6.6-1.1 | 3.6.6-1.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
mbed-tls.readthedocs.io/en/latest/security-advisories
nvd.nist.gov/vuln/detail/CVE-2026-34871
github.com/advisories/GHSA-rjq9-c3rf-c638
security-tracker.debian.org/tracker/CVE-2026-34871
Show 12 moreShow less
ubuntu.com/security/CVE-2026-34871
cve.org/CVERecord?id=CVE-2026-34871
suse.com/security/cve/CVE-2026-25833