Executive brief
Mbed TLS is a widely-used cryptography library that implements TLS protocol support for secure communications. A vulnerability in its TLS 1.3 client implementation fails to properly validate cryptographic groups selected by a server in HelloRetryRequest messages, allowing a malicious server to bypass the client's group security policy and potentially cause handshake failures.
Technical details
The vulnerability is a validation bypass in the TLS 1.3 client handshake logic. When processing a HelloRetryRequest, the RFC 8446 specification requires clients to verify that the server-selected group was present in the client's original supported_groups advertisement. Affected Mbed TLS versions (3.5.0–3.6.6 and 4.0–4.1.1) fail to perform this validation correctly. An attacker controlling a TLS server can send a HelloRetryRequest selecting a group outside the client's advertised list, bypassing the client's configured group restrictions. Attack requires network access, a TLS 1.3 client connection, and a configured group policy. Session keys and certificates are not directly compromised, but security or compliance boundaries relying on group restrictions can be violated. Patches are available in Mbed TLS 3.6.7+ and 4.1.2+.
Affected products
- Mbed TLS Mbed TLS 3.5.0 through 3.6.6, 4.0 through 4.1.1
Timeline
- 2026-07-07: disclosed
- 2026-09-14: advisory
- 2026-07-07: patched: Patches released in Mbed TLS 3.6.7 and 4.1.2