CVE-2026-25832
Low · 3.7CVSS
3.7
EPSS
0.3%
Published
Sep 14, 2026
CISA due date
—
The record
In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2023-32803 The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2)… CWE-669
- CVE-2026-73281 In ssh-agent in OpenSSH before 10.5, some operations can occur remotely but were intended… CWE-669
- CVE-2026-46448 In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. CWE-669
- CVE-2026-12068 Information disclosure vulnerability in Avira Password Manager when used with Mozilla… CWE-669
- CVE-2026-44917 OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager… CWE-669
- CVE-2026-46447 OpenStack Ironic before 35.0.2 allows Boot Script Injection of an iPXE script if the… CWE-669
- CVE-2026-48847 Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication… CWE-669
- CVE-2026-48846 In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image… CWE-669