{"id":"CVE-2026-73064","aliases":["AZL-105561","AZL-105705","DEBIAN-CVE-2026-73064","EUVD-2026-85930","GHSA-crc8-r3c8-83vw","MGASA-2026-0375","UBUNTU-CVE-2026-73064"],"status":"published","title":"In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy...","description":"In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.","severity":{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00103,"percentile":0.00956,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-394"],"published":"2026-09-04T17:53:22Z","modified":"2026-11-05T14:16:02Z","fixes":[{"ecosystem":"Debian:14","package":"mbedtls","fixed_in":["3.6.7-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"24.22.1-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"10.1.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.28.3-1","2.28.4-1","2.28.5-1","2.28.6-1","2.28.7-1","2.28.7-1.1","2.28.7-1.1~exp1","2.28.8-1","3.6.0-1","3.6.0-2","3.6.0-3","3.6.2-1","3.6.2-2","3.6.2-3","3.6.3-1","3.6.4-1","3.6.4-2","3.6.5-0.1","3.6.5-0.1~deb13u1","3.6.6-0.1","3.6.6-0.1~deb13u1","3.6.7-2","3.6.7-3"]},{"source":"osv","ecosystem":"Debian:13","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.4-2","3.6.5-0.1","3.6.5-0.1~deb13u1","3.6.6-0.1","3.6.6-0.1~deb13u1","3.6.7-2","3.6.7-3"]},{"source":"osv","ecosystem":"Debian:14","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-1"}]}],"versions":["3.6.4-2","3.6.5-0.1","3.6.5-0.1~deb13u1","3.6.6-0.1","3.6.6-0.1~deb13u1"]},{"source":"osv","ecosystem":"Mageia:10","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.7-1.mga10"}]}],"bundled":17},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.2-1","2.2.0-1","2.2.1-1","2.2.1-2","2.2.1-2ubuntu0.1","2.2.1-2ubuntu0.2","2.2.1-2ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.1-1ubuntu1","2.6.0-1","2.7.0-2","2.8.0-1","2.8.0-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.16.2-1","2.16.3-1","2.16.4-1ubuntu2","2.16.4-1ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.16.9-0.1ubuntu1","2.16.11-0.1ubuntu1","2.16.11-0.3","2.28.0-1","2.28.0-1build1","2.28.0-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.28.3-1","2.28.6-1ubuntu1","2.28.7-1ubuntu1","2.28.7-1.1ubuntu1","2.28.8-1","2.28.8-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.5-0.1ubuntu2","3.6.6-0.1ubuntu1","3.6.7-3ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"mbedtls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.2-3ubuntu1","3.6.5-0.1ubuntu1","3.6.5-0.1ubuntu2"]}],"products":[{"vendor":"arm","product":"mbed tls"},{"vendor":"trustedfirmware","product":"mbed tls"}],"references":[{"url":"https://github.com/Mbed-TLS/mbedtls","tags":["package"]},{"url":"https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-random-generator-fault-tls-integrity/","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73064","tags":["web","advisory"]},{"url":"https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-random-generator-fault-tls-integrity"},{"url":"https://github.com/advisories/GHSA-crc8-r3c8-83vw"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73064.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-73064","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0375.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35972","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3BALMLPIK3FBKPIGK5RZX3VUWR2QCCGQ/","tags":["web"]},{"url":"https://github.com/Mbed-TLS/mbedtls/releases#release-mbedtls-3.6.7","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-73064","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73064","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-73064","description":"In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.","status":"published","published":"2026-09-24T14:58:38.367Z","modified":"2026-09-24T18:00:20.196Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-394"],"updated_at":"2026-11-02T13:43:22.599321Z"}],"euvd":[{"id":"EUVD-2026-85930","description":"In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.","status":"published","published":"2026-09-24T14:58:38Z","modified":"2026-09-24T18:00:20Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T17:27:56.686358Z"}],"ghsa":[{"id":"GHSA-crc8-r3c8-83vw","title":"In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy...","description":"In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.","status":"published","published":"2026-09-24T15:31:34Z","modified":"2026-09-24T15:31:42Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-394"],"updated_at":"2026-11-02T15:12:22.921703Z"}],"nvd":[{"id":"CVE-2026-73064","description":"In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.","status":"published","published":"2026-09-24T15:17:34.273Z","modified":"2026-09-24T21:04:40.34Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-394"],"updated_at":"2026-11-02T14:12:51.036099Z"}],"osv":[{"id":"CVE-2026-73064","description":"In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.","status":"published","published":"2026-09-24T14:58:38.367Z","modified":"2026-10-28T02:30:47.494804374Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-394"],"updated_at":"2026-11-02T15:45:15.88521Z"},{"id":"DEBIAN-CVE-2026-73064","description":"In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.","status":"published","published":"2026-09-24T15:17:34.273Z","modified":"2026-09-27T18:00:07.893900229Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:46:02.499355Z"},{"id":"UBUNTU-CVE-2026-73064","description":"In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.","status":"published","published":"2026-09-24T15:17:00Z","modified":"2026-10-17T13:00:58.646271321Z","cvss":[{"version":"3.1","score":2.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T16:57:08.628462Z"},{"id":"AZL-105561","title":"CVE-2026-73064 affecting package nodejs 24.22.1-1","description":"In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.","status":"published","published":"2026-09-24T15:17:34Z","modified":"2026-11-05T14:16:02.107777525Z","updated_at":"2026-11-05T16:41:17.719431Z"},{"id":"AZL-105705","title":"CVE-2026-73064 affecting package qemu 10.1.0-1","description":"In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.","status":"published","published":"2026-09-24T15:17:34Z","modified":"2026-10-15T05:37:09Z","updated_at":"2026-11-02T15:28:01.09948Z"},{"id":"MGASA-2026-0375","title":"Updated mbedtls packages fix security vulnerabilities","description":"TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised\ngroup. (CVE-2026-25832)\nPossible buffer overflow in mbedtls_ecdh_calc_secret(). (CVE-2026-35336)\nX.509 CA bit forgery via invalid basicConstraints extension.\n(CVE-2026-49300)\nUse-after-free in mbedtls_pkcs7_free() when reusing a PKCS7 context.\n(CVE-2026-50579)\nRemote buffer overflow in TLS 1.2 ECDHE-PSK client handshake.\n(CVE-2026-50580)\nExtended master secret calculation failure ignored. (CVE-2026-50581)\nA 1-byte buffer overread when parsing a malformed ECC public key in the\nPK module. (CVE-2026-50583)\nChaCha20 counter overflow can reuse keystream. (CVE-2026-50584)\nIncomplete context reset in mbedtls_ssl_session_reset().\n(CVE-2026-50585)\nA potential information disclosure in TLS 1.2 servers using session\ntickets. If the session ticket write callback failed without setting the\nlifetime output parameter, Mbed TLS could send 4 bytes of uninitialized\nstack memory to the peer in the NewSessionTicket message.\n(CVE-2026-50586)\nTiming side-channel in RSA PKCS#1 v1.5 decryption. (CVE-2026-50587)\nOut-of-bounds read in TLS 1.2 EC J-PAKE ServerKeyExchange parsing.\n(CVE-2026-50588)\nIgnored TLS 1.3 resumption secret derivation error. (CVE-2026-50640)\nHeap corruption with early renegotiation after corrupted record in DTLS.\n(CVE-2026-50713)\nSide channel leak in ECC optimized modp. (CVE-2026-54435)\nSignature algorithm restrictions not enforced on certificate chain.\n(CVE-2026-54441)\nA random generator fault can compromise TLS data integrity.\n(CVE-2026-73064)\n","status":"published","published":"2026-09-04T17:53:22Z","modified":"2026-09-04T18:00:03.366057546Z","updated_at":"2026-11-02T15:49:43.795591Z"}]}}