Every CVE Search/ Get API key

CVE-2026-50588

Updated mbedtls packages fix security vulnerabilities

No scoreFix available

TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group. (CVE-2026-25832) Possible buffer overflow in mbedtls_ecdh_calc_secret(). (CVE-2026-35336) X.509 CA bit forgery via invalid basicConstraints extension. (CVE-2026-49300) Use-after-free in mbedtls_pkcs7_free() when reusing a PKCS7 context. (CVE-2026-50579) Remote buffer overflow in TLS 1.2 ECDHE-PSK client handshake. (CVE-2026-50580) Extended master secret calculation failure ignored. (CVE-2026-50581) A 1-byte buffer overread when parsing a malformed ECC public key in the PK module. (CVE-2026-50583) ChaCha20 counter overflow can reuse keystream. (CVE-2026-50584) Incomplete context reset in mbedtls_ssl_session_reset(). (CVE-2026-50585) A potential information disclosure in TLS 1.2 servers using session tickets. If the session ticket write callback failed without setting the lifetime output parameter, Mbed TLS could send 4 bytes of uninitialized stack memory to the peer in the NewSessionTicket message. (CVE-2026-50586) Timing side-channel in RSA PKCS#1 v1.5 decryption. (CVE-2026-50587) Out-of-bounds read in TLS 1.2 EC J-PAKE ServerKeyExchange parsing. (CVE-2026-50588) Ignored TLS 1.3 resumption secret derivation error. (CVE-2026-50640) Heap corruption with early renegotiation after corrupted record in DTLS. (CVE-2026-50713) Side channel leak in ECC optimized modp. (CVE-2026-54435) Signature algorithm restrictions not enforced on certificate chain. (CVE-2026-54441) A random generator fault can compromise TLS data integrity. (CVE-2026-73064)

What each source reports

OSVMGASA-2026-0375 No score

Updated mbedtls packages fix security vulnerabilities

TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group. (CVE-2026-25832) Possible buffer overflow in mbedtls_ecdh_calc_secret(). (CVE-2026-35336) X.509 CA bit forgery via invalid basicConstraints extension. (CVE-2026-49300) Use-after-free in mbedtls_pkcs7_free() when reusing a PKCS7 context. (CVE-2026-50579) Remote buffer overflow in TLS 1.2 ECDHE-PSK client handshake. (CVE-2026-50580) Extended master secret calculation failure ignored. (CVE-2026-50581) A 1-byte buffer overread when parsing a malformed ECC public key in the PK module. (CVE-2026-50583) ChaCha20 counter overflow can reuse keystream. (CVE-2026-50584) Incomplete context reset in mbedtls_ssl_session_reset(). (CVE-2026-50585) A potential information disclosure in TLS 1.2 servers using session tickets. If the session ticket write callback failed without setting the lifetime output parameter, Mbed TLS could send 4 bytes of uninitialized stack memory to the peer in the NewSessionTicket message. (CVE-2026-50586) Timing side-channel in RSA PKCS#1 v1.5 decryption. (CVE-2026-50587) Out-of-bounds read in TLS 1.2 EC J-PAKE ServerKeyExchange parsing. (CVE-2026-50588) Ignored TLS 1.3 resumption secret derivation error. (CVE-2026-50640) Heap corruption with early renegotiation after corrupted record in DTLS. (CVE-2026-50713) Side channel leak in ECC optimized modp. (CVE-2026-54435) Signature algorithm restrictions not enforced on certificate chain. (CVE-2026-54441) A random generator fault can compromise TLS data integrity. (CVE-2026-73064)

Record
MGASA-2026-0375
Updated
2026-11-02
OSVopenSUSE-SU-2026:11215-1 No score

libmbedtls23-4.2.0-1.1 on GA media

These are all security issues fixed in the libmbedtls23-4.2.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11215-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:11267-1 No score

libeverest-3.6.7-1.1 on GA media

These are all security issues fixed in the libeverest-3.6.7-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11267-1
Updated
2026-11-02
OSVUBUNTU-CVE-2026-50588 No score

[Unknown description]

Record
UBUNTU-CVE-2026-50588
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
mbedtls
Debian:12
 All versions, plus listed versions
2.28.3-12.28.4-12.28.5-12.28.6-12.28.7-1
Show 17 moreShow less
2.28.7-1.12.28.7-1.1~exp12.28.8-13.6.0-13.6.0-23.6.0-33.6.2-13.6.2-23.6.2-33.6.3-13.6.4-13.6.4-23.6.5-0.13.6.5-0.1~deb13u13.6.6-0.13.6.7-23.6.7-3
 None known
mbedtls
Debian:13
 All versions, plus listed versions
3.6.4-23.6.5-0.13.6.5-0.1~deb13u13.6.6-0.13.6.7-23.6.7-3
 None known
mbedtls
Debian:14
 before 3.6.7-2, plus listed versions
3.6.4-23.6.5-0.13.6.5-0.1~deb13u13.6.6-0.1
3.6.7-2
mbedtls
Mageia:10
From an advisory covering 17 CVEs
 before 3.6.7-1.mga10
3.6.7-1.mga10
mbedtls
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.1.2-12.2.0-12.2.1-12.2.1-22.2.1-2ubuntu0.12.2.1-2ubuntu0.22.2.1-2ubuntu0.3
 None known
mbedtls
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.5.1-1ubuntu12.6.0-12.7.0-22.8.0-12.8.0-1ubuntu0.1~esm1
 None known
mbedtls
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2.16.2-12.16.3-12.16.4-1ubuntu22.16.4-1ubuntu2+esm1
 None known
mbedtls
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2.16.9-0.1ubuntu12.16.11-0.1ubuntu12.16.11-0.32.28.0-12.28.0-1build12.28.0-1ubuntu0.1~esm1
 None known
mbedtls
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
2.28.3-12.28.6-1ubuntu12.28.7-1ubuntu12.28.7-1.1ubuntu12.28.8-12.28.8-1ubuntu0.1~esm1
 None known
mbedtls
Ubuntu:26.10
 All versions, plus listed versions
3.6.5-0.1ubuntu23.6.6-0.1ubuntu13.6.7-3ubuntu1
 None known
mbedtls
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.6.2-3ubuntu13.6.5-0.1ubuntu13.6.5-0.1ubuntu2
 None known
mbedtls
openSUSE:Tumbleweed
From an advisory covering 10 CVEs
 before 4.2.0-1.1
4.2.0-1.1
mbedtls-3
openSUSE:Tumbleweed
From an advisory covering 16 CVEs
 before 3.6.7-1.1
3.6.7-1.1

History

History
RecordedChangedSources
affected, facts
first indexedOSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-50588 is a vulnerability with no CVSS score yet in mbedtls, published July 8, 2026. No source lists public exploit code. Fixed in mbedtls 3.6.7-2.

References

Show 17 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open