mbed tls vulnerabilities and fixes

Recent CVEs affecting mbed tls, with upgrade or downgrade steps. 11 tracked.

Also searched as: mbedtls.

mbed tls has 11 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 11. Most recent: 2026-04-02. Highest priority: CVE-2026-34877 (score 48/100).

• CVE-2026-34877 CRITICAL 9.8 UPGRADE DOWNGRADE An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0
• CVE-2026-34876 HIGH 7.5 UPGRADE An issue was discovered in Mbed TLS 3.x before 3.6.6
• CVE-2026-34875 CRITICAL 9.8 UPGRADE UPGRADE An issue was discovered in Mbed TLS through 3.6.5 and TF-PSA-Crypto 1.0.0
• CVE-2026-34874 HIGH 7.5 UPGRADE An issue was discovered in Mbed TLS through 3.6.5 and 4.x through 4.0.0
• CVE-2026-34873 CRITICAL 9.1 UPGRADE An issue was discovered in Mbed TLS 3.5.0 through 4.0.0
• CVE-2026-34872 CRITICAL 9.1 UPGRADE DOWNGRADE An issue was discovered in Mbed TLS 3.5.x and 3.6.x through 3.6.5 and TF-PSA-Crypto 1.0
• CVE-2026-34871 MEDIUM 6.7 UPGRADE UPGRADE An issue was discovered in Mbed TLS before 3.6.6 and 4.x before 4.1.0 and TF-PSA-Crypto before 1.1.0
• CVE-2026-25835 HIGH 7.7 UPGRADE DOWNGRADE Mbed TLS before 3.6.6 and TF-PSA-Crypto before 1.1.0 misuse seeds in a Pseudo-Random Number Generator (PRNG).
• CVE-2026-25834 MEDIUM 6.5 UPGRADE Mbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade.
• CVE-2026-25833 HIGH 7.5 UPGRADE Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the x509_inet_pton_ipv6() function
• CVE-2025-66442 MEDIUM 5.1 UPGRADE UPGRADE In Mbed TLS through 4.0.0, there is a compiler-induced timing side channel (in RSA and CBC/ECB decryption) tha

FAQ

How do I fix mbed tls vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is mbed tls being exploited right now?

None of the tracked mbed tls CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which mbed tls CVE should I patch first?

CVE-2026-34877 currently ranks highest (48/100): An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0.

RSS feed for mbed tls · ← Back to latest CVEs