CVE-2026-73064

In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.

  • Published Sep 24, 2026
  • CVSS 2.9 low
  • 0.1% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-73064 at the National Vulnerability Database