Mbed TLS CVE-2026-25832: Unannounced group in TLS 1.3 HelloRetryRequest

TLS 1.3 Client Accepts HelloRetryRequest With Unannounced Group (CVE-2026-25832) Vulnerability Overview When an Mbed TLS 1.3 client processes a TLS 1.3 , it must verify that the is included in the server's extension. If this extension is missing, RFC 8446 requires the client to abort the handshake. The affected versions fail to perform this check correctly, allowing a malicious or faulty server to bypass the client's security policy by selecting a cryptographic group that the client did not announce, or to compress session keys or certificates when an unacceptable group is selected. Scope of Impact Affected Versions: Mbed TLS 3.5 through 3.6.x; Mbed TLS 4.x versions up to 4.1.1 Unaffected: Mbed TLS 3.4.1 and earlier; Mbed TLS 3.6.7 and later; Mbed TLS 4.1.2 and later Severity: LOW Impact: May result in a limited Denial of Service (DoS) under certain configurations Trigger Conditions The application is affected when all of the following conditions are met: TLS 1.3 client support is enabled TLS 1.3 ephemeral or PSK key exchange modes are enabled The application has configured restrictions on the groups the client can offer (e.g., via or equivalent configuration) The client connects to a malicious or faulty server that sends a announcing a group not announced by the client Workarounds If upgrading is not feasible, exposure can be mitigated by disabling TLS 1.3 client support or by only connecting to trusted servers that cannot send malicious messages. Applications are not affected if they have not enabled TLS 1.3 client support, use only TLS 1.3 PSK-only key exchange, or do not rely on the TLS 1.3 supported groups list as a security or compliance boundary. Fix 3.6 Series: Affected users should upgrade to 3.6.7 or later. 4.x Series: Affected users should upgrade to 4.1.2 or later. Fix Commits: Users are advised to upgrade to a release that includes the fix. If maintaining a branch with backports, the following related commits can be used (note: these commits may not apply directly to older versions, and the Mbed TLS development team does not guarantee support outside of maintenance branches).

Goal Reached Thanks to every supporter — we hit 100%!

Mbed TLS CVE-2026-25832: Unannounced group in TLS 1.3 HelloRetryRequest