# CVE-2026-25832: Mbed TLS TLS 1.3 HelloRetryRequest group validation bypass

Source: https://junglewise.ai/threats/cve-2026-25832-mbed-tls-tls-1-3-helloretryrequest-group-validation-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-25832 · Severity: low · CVSS 3.7 · Published 2026-09-14

Mbed TLS is a widely-used cryptography library that implements TLS protocol support for secure communications. A vulnerability in its TLS 1.3 client implementation fails to properly validate cryptographic groups selected by a server in HelloRetryRequest messages, allowing a malicious server to bypass the client's group security policy and potentially cause handshake failures.

## Quick answers

**Is CVE-2026-25832 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25832 being exploited in the wild.

**How severe is CVE-2026-25832?** Low severity, with a CVSS score of 3.7, published 14 September 2026.

**Which products and versions are affected?** Mbed TLS Mbed TLS 3.5.0 through 3.6.6, 4.0 through 4.1.1.

**Is there a fix for CVE-2026-25832?** A patch was published on 2026-07-07: Patches released in Mbed TLS 3.6.7 and 4.1.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25832 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-25832?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a validation bypass in the TLS 1.3 client handshake logic. When processing a HelloRetryRequest, the RFC 8446 specification requires clients to verify that the server-selected group was present in the client's original supported_groups advertisement. Affected Mbed TLS versions (3.5.0–3.6.6 and 4.0–4.1.1) fail to perform this validation correctly. An attacker controlling a TLS server can send a HelloRetryRequest selecting a group outside the client's advertised list, bypassing the client's configured group restrictions. Attack requires network access, a TLS 1.3 client connection, and a configured group policy. Session keys and certificates are not directly compromised, but security or compliance boundaries relying on group restrictions can be violated. Patches are available in Mbed TLS 3.6.7+ and 4.1.2+.

## Affected products

- Mbed TLS Mbed TLS 3.5.0 through 3.6.6, 4.0 through 4.1.1

## Timeline

- 2026-07-07: disclosed
- 2026-09-14: advisory
- 2026-07-07: patched: Patches released in Mbed TLS 3.6.7 and 4.1.2

## References

- [https://mbed-tls.readthedocs.io/en/latest/security-advisories/](https://mbed-tls.readthedocs.io/en/latest/security-advisories/)
- [https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-tls13-hrr-unadvertised-group/](https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-tls13-hrr-unadvertised-group/)