CVE-2026-73064

Severity: low (CVSS 2.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-24 · updated 2026-09-24
Weakness: CWE-394

Description

In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.

Affected products

TrustedFirmware Mbed TLS: from 3.2.0 before 3.6.7; from 4.0.0 before 4.1.1 — fixed in 3.6.7, 4.1.1

How to fix

Upgrade to a fixed version: TrustedFirmware Mbed TLS 3.6.7, 4.1.1. Check the vendor advisory for mitigations.

References

https://github.com/Mbed-TLS/mbedtls
https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-random-generator-fault-tls-integrity/

Get alerted when CVE-2026-73064 or the next vulnerability affects your stack