TLS 1.3 Client Vulnerability in Mbed TLS by Arm

CVE-2026-25832

What is CVE-2026-25832?

In the affected versions of Mbed TLS, the TLS 1.3 client is vulnerable to a flaw during the HelloRetryRequest phase, allowing it to select an unadvertised group. This can introduce potential security risks in communications, as the client may be manipulated into accepting configurations that were not properly advertised by the server, leading to possible exploits in secure data exchanges.

References