PatchTheCVECVE-2026-1677: Zephyr sockets created with `IPPROTO_TLS_1_3` can still negotiate a TLS 1.2 connection when both TLS versions
CVE-2026-1677 is a medium-severity flaw (CVSS 5.3) affecting zephyr. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Zephyr sockets created with `IPPROTO_TLS_1_3` can still negotiate a TLS 1.2 connection when both TLS versions are enabled in Kconfig, because the socket-level protocol selection is not propagated to mbedTLS (e.g. via `mbedtls_ssl_conf_min_tls_version`). The ClientHello advertises both versions and the peer can establish TLS 1.2, so applications that assumed `IPPROTO_TLS_1_3` enforces TLS 1.3 may silently use TLS 1.2 and remain exposed to TLS 1.2-
Why this priority
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 85%) |
| CISA exploited list | No |
| Weakness | CWE-757 |
| Published | 2026-05-11 |
| Last modified | 2026-10-26 |
Last updated 2026-10-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-1677?
zephyr: upgrade to newer than 4.3.0. Exact commands for each OS are on this page.
Is CVE-2026-1677 being exploited?
CVE-2026-1677 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-1677 affect?
CVE-2026-1677 affects zephyr. Severity is medium (CVSS 5.3). Zephyr sockets created with `IPPROTO_TLS_1_3` can still negotiate a TLS 1.2 connection when both TLS versions are enabled in Kconfig, because the socket-level protocol selection is not propagated to mbedTLS (e.g. via `mbedtls_ssl_conf_min_t
How urgent is CVE-2026-1677?
Priority 32/100. Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2026-1681 MEDIUM 6.1 UPGRADE Issuing an ICMP ping via the `net ping` shell command to a device's own IPv4 address causes the network stack
- CVE-2026-10638 MEDIUM 5.9 UPGRADE subsys/net/ip/icmpv6.c reads the network interface from a net_pkt after that packet has been handed to net_try
- CVE-2026-10637 MEDIUM 5.9 UPGRADE subsys/net/ip/ipv6_mld.c:mld_send() read the packet interface via net_pkt_iface(pkt) after net_send_data(pkt)
- CVE-2026-10641 HIGH 7.1 UPGRADE Zephyr's Bluetooth Classic Hands-Free Profile (HFP) Hands-Free role parser (subsys/bluetooth/host/classic/hfp_
- CVE-2026-10651 HIGH 7.1 UPGRADE bt_sdp_parse_attribute() in subsys/bluetooth/host/classic/sdp.c validated only that the SDP record buffer held