CVE-2024-28755

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-03 · updated 2026-06-17
Weakness: CWE-326

Description

An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtls_ssl_session_reset() API, the maximum TLS version to be negotiated was not restored to the configured one. An attacker was able to prevent an Mbed TLS server from establishing any TLS 1.3 connection, potentially resulting in a Denial of Service or forced version downgrade from TLS 1.3 to TLS 1.2.

Affected products

TrustedFirmware Mbed TLS: from 3.5.0 through 3.6.0

References

https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0
https://github.com/hey3e
https://hey3e.github.io
https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/
https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0
https://github.com/hey3e
https://hey3e.github.io
https://mbed-tls.readthedocs.io/en/latest/tech-updates/security-advisories/

Get alerted when CVE-2024-28755 or the next vulnerability affects your stack