CVE-2024-30166: Trustedfirmware Mbed TLS

Critical severity, CVSS 9.1. EPSS: 0.7% chance of exploitation in the next 30 days.

In Mbed TLS 3.3.0 through 3.5.2 before 3.6.0, a malicious client can cause information disclosure or a denial of service because of a stack buffer over-read (of less than 256 bytes) in a TLS 1.3 server via a TLS 3.1 ClientHello.

Affected products

• Trustedfirmware Mbed TLS: from 3.3.0, before 3.6.0 (fixed in 3.6.0)

Published 2024-04-03. Last modified 2026-06-17.