{"id":"CVE-2026-73064","revision":"fd4fedd9a64a4acaada9f38685aa3991","records":[{"revision":"fd4fedd9a64a4acaada9f38685aa3991","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-73064","aliases":[],"title":"In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.","description":"In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start of the TLS stream. This only affects TLS 1.3 servers.","state":0,"publishedAt":"2026-09-24T14:58:38.367+00:00","modifiedAt":"2026-09-24T18:00:20.196+00:00","affected":[{"ecosystem":"Vendor product","name":"Mbed TLS","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"product\": \"Mbed TLS\",\n                    \"repo\": \"https://github.com/Mbed-TLS/mbedtls\",\n                    \"vendor\": \"trustedfirmware\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"3.6.7\",\n                            \"status\": \"affected\",\n                            \"version\": \"3.2.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThan\": \"4.1.1\",\n                            \"status\": \"affected\",\n                            \"version\": \"4.0.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","score":2.9,"severity":"LOW"}],"references":["https://github.com/Mbed-TLS/mbedtls","https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-random-generator-fault-tls-integrity/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-73064","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-73064","identifiers":["CVE-2026-73064"]},"retained":false,"historicalAffected":[]}],"coverage":[]}