CVE-2026-73064: Trustedfirmware Mbed TLS

Low severity, CVSS 2.9. EPSS: 0.1% chance of exploitation in the next 30 days.

In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.

Affected products

• Trustedfirmware Mbed TLS: from 3.2.0, before 3.6.7 (fixed in 3.6.7); from 4.0.0, before 4.1.1 (fixed in 4.1.1)

Published 2026-09-24. Last modified 2026-09-24.