Executive brief
Mbed TLS is a widely used open-source library that provides secure communication capabilities for devices and applications. A vulnerability has been identified where an attacker can bypass security checks to impersonate a legitimate user during the reconnection process. This could allow unauthorized access to sensitive data or systems that rely on Mbed TLS for identity verification.
Technical details
An improper authentication vulnerability (CWE-287) exists in Mbed TLS when a server supporting both TLS 1.2 and 1.3 attempts to resume a TLS 1.3 session. If the server issues a HelloRetryRequest and a man-in-the-middle attacker intercepts it, they can respond with a ClientHello that negotiates TLS 1.2. The server incorrectly proceeds with the resumption using an all-zero master secret, allowing the attacker to complete the handshake without valid credentials. This bypasses client authentication guarantees and can lead to full client impersonation. The issue is fixed in versions 3.6.6 and 4.1.0.
Affected products
- Arm Mbed TLS 3.5.0 to 3.6.5, 4.0.0
- TrustedFirmware Mbed TLS 3.5.0 to 3.6.5, 4.0.0
Timeline
- 2026-03-31: advisory: Vendor advisory published by Mbed TLS team
- 2026-04-01: disclosed: CVE-2026-34873 assigned
- 2026-04-07: patched: NIST initial analysis and confirmation of fix versions 3.6.6 and 4.1.0