CVE-2026-73064
Low · 2.9CVSS
2.9
EPSS
0.1%
Published
Sep 24, 2026
CISA due date
—
The record
In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-76956 In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code… CWE-394
- CVE-2026-25085 A vulnerability exists in Copeland XWEB Pro version 1.12.1 and prior, in which an… CWE-394
- CVE-2025-23013 In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. CWE-394
- CVE-2024-1713 A user who can create objects in a database with plv8 3.2.1 installed is able to cause… CWE-394