CVE-2026-25834: Trustedfirmware Mbed TLS

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

Mbed TLS v3.3.0 up to 3.6.5 and 4.0.0 allows Algorithm Downgrade.

Affected products

• Trustedfirmware Mbed TLS: from 3.3.0, before 3.6.6 (fixed in 3.6.6); version 4.0.0 only

Published 2026-04-01. Last modified 2026-06-17.