TLS 1.3 Vulnerability in Zephyr Sockets by Zephyr Project

CVE-2026-1677

What is CVE-2026-1677?

The vulnerability in Zephyr sockets allows connections using IPPROTO_TLS_1_3 to negotiate a TLS 1.2 connection due to incomplete enforcement of minimum TLS version settings. This issue occurs when both TLS versions are enabled in Kconfig, which results in socket control not being effectively passed to mbedTLS. Consequently, applications relying on IPPROTO_TLS_1_3 to enforce TLS 1.3 may inadvertently fall back to TLS 1.2, exposing them to known vulnerabilities inherent to the older protocol. Users are advised to configure the TLS_CIPHERSUITE_LIST to prioritize TLS 1.3-only cipher suites as a mitigating measure.

References